How Governments Fail to Stop Ransomware’s Newest Weapon: Physical Threats Against Employees
Ransomware has always been about leverage—locking data until victims pay. But now, attackers are adding a new layer: threats against people. A global survey shows 40% of ransomware attacks in the past year included psychological or physical coercion, with attackers following through in more than half of those cases. Think of it like a protection racket, but with encryption keys instead of bricks. Here’s what that means for businesses, governments, and the law—and why current rules are failing to stop it.
From Code to Coercion: How Ransomware Got Personal
Ransomware used to be a digital hostage situation. Attackers encrypted files, demanded cryptocurrency, and hoped victims would pay. But as defenses improved—better backups, faster recovery—so did the tactics. First came double extortion: encrypt data and threaten to leak it if the ransom wasn’t met. Now, according to Semperis’ 2026 Ransomware Risk Report, 40% of attacks include threats against employees or their families. In 53% of those cases, attackers carried out the threats. Fourteen percent of organizations reported staff or family members forced to relocate, change jobs, or move offices to escape harassment.
The shift isn’t just about fear. It’s about exploiting a weakness that laws can’t easily address. Ransomware is already hard to prosecute—payments are made in untraceable cryptocurrency, and attackers often operate from countries with little cooperation. But physical threats add a new wrinkle: they blur the line between cybercrime and extortion, leaving gaps in statutes that treat one as a digital offense and the other as a physical one. No major country has explicitly criminalized physical threats in ransomware attacks, leaving victims with no clear legal recourse.
Here’s the practical upshot: If an attacker encrypts your files and then calls your CEO’s wife to say they’ll leak her medical records unless you pay, what law do you break? Cybercrime? Extortion? Both? The answer is often neither, at least not cleanly.
AI Turns Ransomware Into a Self-Serving Machine
Behind the threats is a technological arms race. Artificial intelligence was weaponized in 84% of the ransomware attacks surveyed by Semperis, turning what was once a labor-intensive crime into something almost automated. Chris Inglis, a former U.S. National Cyber Director and Semperis adviser, calls it an “inflection point.” AI doesn’t just help attackers find vulnerabilities—it lets them tailor social engineering schemes to specific employees, automate intrusions, and even negotiate ransom demands without human oversight.
Think of it like a self-checkout kiosk for cybercrime. A low-skilled attacker can now instruct an AI to write the code needed to breach a network, identify weak spots in identity systems (which were targeted in 87% of incidents), and escalate pressure by threatening employees. The result? More attacks, faster execution, and less room for error on the victim’s side. Sixty-nine percent of surveyed organizations faced multiple attacks in the past year, and 31% made multiple ransom payments—often because the first demand wasn’t enough to make the threats stop.
Autonomous ransomware—where AI handles intrusion, encryption, and even negotiation—is already emerging, Inglis says. That means the cycle of attack and counterattack is accelerating, with little time for human defenders to react.
The Numbers Behind the Escalation
The data paints a clear picture of how ransomware has evolved:
- 84% of attacks used AI, either to automate breaches or tailor threats.
- 40% included physical or psychological coercion, with attackers following through in 53% of cases.
- 87% targeted identity systems, the digital gates that control access to networks.
- 70% of victims faced multiple attacks, and 31% paid ransoms more than once.
- 14% of organizations reported employees or family members forced to relocate due to threats.
Global ransomware payments peaked at $1.25 billion in 2023 but dropped to $813 million in 2024, partly because victims are refusing to pay and law enforcement is disrupting operations. Yet the human cost is rising. The Semperis survey polled 1,200 IT and security professionals across nine countries, revealing a trend: attackers are no longer just after data. They’re after fear.
Why Laws Can’t Keep Up
The problem isn’t just technical—it’s legal. Current statutes treat ransomware primarily as a cybercrime, but physical threats fall into gaps between digital and physical extortion laws. Cross-border investigations become nearly impossible when attackers operate from jurisdictions with weak cooperation, and victims often lack clear evidence to prosecute.
Inglis puts it bluntly: “Holding you at physical risk is the latest phenomenon because we’ve covered most of the other risks.” Attackers adapt when defenses improve. First, it was encryption. Then, data theft. Now, it’s direct pressure on people. The question for governments isn’t just how to stop the attacks—it’s how to update laws that were written for a world where ransomware was just about code.
The practical upshot? Without legal reforms, victims are left choosing between paying ransoms or enduring harassment. And with AI making attacks faster and more precise, the window for action is closing.
How Attackers Exploit Identity Systems to Escalate Threats
The shift toward targeting identity systems—cited in 87% of ransomware incidents by Semperis—isn’t just about gaining access. It’s about creating leverage. Attackers exploit weaknesses in identity infrastructure to map out an organization’s most vulnerable employees, then weaponize that intelligence. According to the 2026 Ransomware Risk Report, 40% of attacks now include threats against employees or their families, with 53% of those threats carried out. The pattern is clear: once inside, attackers don’t just encrypt data—they identify who has the authority to make decisions, who holds sensitive personal information, and who might be most susceptible to coercion.
Identity systems, which control access to networks, are the digital keys to an organization’s most critical assets. When compromised, they reveal not just passwords but also personal details—medical records, family connections, or financial data—that attackers can use to pressure victims. The report highlights that 14% of organizations reported employees or family members forced to relocate or change jobs due to sustained harassment. This isn’t random intimidation; it’s a calculated strategy to exploit the human element of cybersecurity. As Chris Inglis, former U.S. National Cyber Director, notes, attackers are “always evolving their tactics” once defenses improve, and identity systems provide the perfect entry point to escalate from digital extortion to physical coercion.
The problem is compounded by the fact that identity systems are often overlooked in cybersecurity planning. While organizations invest heavily in firewalls and encryption, the human layer—where attackers apply pressure—remains underprotected. The Semperis survey reveals that 70% of victims faced multiple attacks, with 31% making repeated ransom payments, often because the first demand wasn’t enough to stop the harassment. This suggests that attackers are using identity data not just to breach networks but to maintain control over victims long after the initial encryption. Without legal frameworks that address these hybrid threats, organizations are left with no clear path to recovery beyond compliance or capitulation.
Sources
- AI Weaponized in 84% of Ransomware Attacks, According to a New Survey – The Daily Hodl
- Ransomware
- AI linked to 84% of ransomware attacks, new report finds
Photo: The Jopwell Collection / Unsplash (Unsplash License)
