Semperis says four in ten ransomware attacks in its latest survey came with threats against staff, and attackers acted on those threats more often than not. The same report finds identity systems in the firing line almost every time, while recovery plans for them still lag.
What happened
Semperis, the US identity resilience and incident response firm, published its 2026 Ransomware Risk Report on 14 October 2026. The study only counts organisations that were hit by ransomware during the previous 12 months, and it spans nine countries, including the UK, the US, Germany, France and Australia. The Register, which reported on the findings the same day, describes the sample as 1,200 organisations surveyed during the first half of 2026.
The headline finding is personal. According to the press release, four in ten attacks came with intimidation or threats of physical harm aimed at employees, and in 53% of cases victims said the criminals went on to carry those threats out. Nearly a quarter of victims or their relatives were swatted, meaning someone made a hoax emergency call to send armed police to their home. A quarter of victims needed psychological or medical help after the incident, and 24% hired personal security.
The Register’s write-up puts the share of attacks involving staff threats slightly lower, at 37%, and breaks the threats down further: threatening texts, letters or parcels were the most common, followed by threats against family and friends, physical intrusion, abduction, bodily harm and stalking.
Nearly 70% of victims were targeted more than once, and 31% paid more than once. Semperis also reports that attackers used AI in 87% of incidents. A version of the findings carried by International Security Journal gives 84% globally and, according to that outlet, 88% for attacks on UK organisations.
The technical picture
Semperis says 87% of attacks went after identity platforms such as Active Directory, Microsoft Entra ID and Okta. Elsewhere in the same release the firm says nearly three quarters of successful attacks targeted or exploited the identity system, so the exact proportion depends on which measure you use.
That makes sense when you look at how modern intrusions unfold. Once an attacker controls a domain admin account, a privileged cloud role or the identity provider itself, they can push ransomware through group policy, disable security tooling, create persistence that survives a password reset and read the mailboxes where the response is being coordinated. Nothing else can be safely restored until the directory is trusted again.
This is where the survey points to a real gap. Only around half of respondents keep dedicated backups of their identity systems, fewer than half have automated identity recovery, and 40% said their disaster recovery or crisis plans contain no procedure for restoring Active Directory. Chris Inglis, who advises Semperis and was previously the US National Cyber Director, put it bluntly: “Identity is the coin of the realm.”
The human threats work on the same logic as double extortion. Encryption was answered by better backups, so criminals added data theft. Data theft is now answered by firms that refuse to pay, so some crews are adding pressure on the people making the decision. Semperis incident responder Tim Beasley told The Register he had seen executives sent images of their children’s schools, and named Scattered Spider, ShinyHunters and Lapsus$ among groups using these tactics.
Why it matters for UK organisations
The UK has spent the past two years absorbing high-profile ransomware and extortion incidents in retail, manufacturing, the public sector and education. Several of the groups Beasley names are known for social engineering by phone in fluent English, which makes reconnaissance on staff easier and threats more believable.
For UK employers this widens the incident from a technical problem to a duty of care issue. If a member of the IT team is doxxed or a director’s family receives a threatening parcel, HR, physical security, legal and the police all need to be in the room alongside the SOC. Most UK playbooks I review still treat ransomware as a systems outage with a communications workstream bolted on. Very few cover what to do when an attacker phones a sysadmin at home.
With almost seven in ten victims hit again and nearly a third paying more than once, paying appears to buy little peace. That aligns with the long-standing UK government position of discouraging ransom payments.
Expert view
Vendor surveys deserve caution: Semperis sells identity recovery, and the figures vary between versions of its own release, so read them as direction rather than precision. Even so, the core message matches what I see on engagements.
When we run red team exercises against UK organisations, the route to a damaging outcome almost always runs through identity: a phished helpdesk reset, a stale service account with excessive rights, a poorly tiered admin model, or a hybrid sync server nobody treats as a crown jewel. In my experience, organisations that can rebuild a clean forest from a known-good backup, in an isolated environment, recover in days rather than weeks.
The threats against people are the part that should change how SOC leaders plan. Attackers do open source reconnaissance on staff long before they encrypt anything. Assume the attacker knows who your CISO, incident lead and senior administrators are, and where they live. Beasley’s advice to victims was to “stand your ground”, bring in law enforcement early and refuse to pay. That is easier to do when the organisation has already decided who carries that pressure and how they will be protected.
What to do now
- Back up identity separately. Keep offline, immutable backups of Active Directory and configuration exports for Entra ID and Okta, and test a full forest recovery into an isolated environment at least annually.
- Write the AD recovery runbook. If your crisis plan does not explain how to restore and re-trust the directory, fix that first. Include an out-of-band communications channel in case email and chat are compromised.
- Tier and reduce privileged access. Separate admin accounts, remove standing domain admin rights and enforce phishing-resistant MFA for all privileged roles. This maps directly to the Cyber Essentials user access control requirements.
- Harden helpdesk and reset processes. Require strong identity verification before any password or MFA reset, especially for administrators.
- Monitor identity for attack signals. Alert on new privileged group members, changes to group policy, unusual replication requests and federation changes.
- Add a staff protection workstream. Brief key staff on doxxing and swatting risk, review what personal details are public, agree when to call the police, and give HR and physical security clear roles in the ransomware playbook.
- Decide your payment stance in advance. Agree the position with the board and insurers before an incident, not during one.
Bottom line
Semperis’s data suggests ransomware crews now apply pressure to systems and people at the same time. The defensive answer is unglamorous: treat identity as the asset you must be able to rebuild from scratch, and treat your staff as part of the attack surface that needs a protection plan. UK organisations that rehearse both will be far better placed to resist demands.
Sources
- PR Newswire: Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats Against Executives and Their Families
- The Register: Ransomware gets personal: ‘We-know-where-you-are kind of stuff’
- International Security Journal: Semperis unveils results from its 2026 Ransomware Risk Report
