1. Executive summary
Semperis has published its 2026 Ransomware Risk Report, a survey of 1,200 IT and security professionals at organisations that suffered at least one successful ransomware attack, and reports that 37% of those organisations saw attackers threaten employees' family members or friends. The same survey records swatting at 23% of respondents, doxxing at a quarter, and 53% saying attackers carried through on threats in the past year. No CVE, malware family or infrastructure is attached to this item, so there is nothing to patch or block; the exposure is to staff safety, incident-response decision-making and the pressure to restore and pay before the attacker is removed. For EMEA financial services the material findings are that identity systems were the target in 87% of cases and only half of respondents held dedicated identity backups, which puts Active Directory, Entra ID and Okta recovery planning ahead of perimeter controls in this report.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 17 | The report records that pressure to resume operations leads organisations to restore services before establishing whether attackers have been removed, and that 69% suffered multiple successful attacks within a year. | The incident management process must define exit criteria for containment before restoration, and must cover repeat intrusion, not a single recovery event. |
| DORA Art. 18 | Threats of physical harm, swatting and doxxing against staff and their families are a consequence of an ICT-related incident recorded across 37% of respondents. | Classification must account for harm to people, not only service disruption and data loss; the threat component of the article applies where an attack is threatened but not yet executed. |
| NIS2 Art. 21(2)(d) | Attackers reached victims through social media reconnaissance of employees and their families, and 87% of cases involved identity systems that govern supplier and third-party access. | Supply chain security measures extend to the personal exposure of staff who hold privileged access, and to identity providers as a dependency. |
3. Technical analysis & attack chain
This is a survey report, not a technical incident write-up. It contains no exploited component, no payload, no command-and-control detail and no atomic indicators. What it does describe is a sequence of attacker behaviour reported by respondents, and that sequence is set out below. Every step rests on self-reported survey data from a single vendor study; none of it is corroborated by an independent technical source in the material available.
- The attacker gains and retains access to the environment. The report does not describe the initial access vector. It states that recovery requires teams to find how the criminals entered and remove their access, and that malware, backdoors and compromised accounts can give intruders a way back in.
- Identity systems are targeted or exploited. Respondents report this in 87% of cases, naming Active Directory, Entra ID and Okta. Control of these systems lets an attacker reach connected services, change user privileges and interfere with recovery.
- Pressure is applied outside the technical estate. Attackers use social media reconnaissance against employees and, per The Register's interview with Semperis consultant Tim Beasley, send executives photographs of their children's schools. Reported methods include threatening texts, letters and packages (57%), threats against family or friends (37%), physical intrusion (19%), threats of abduction (17%), threats of bodily harm (13%) and stalking (6%).
- Harassment is escalated through third parties. Swatting, reported by 23%, means a false emergency report to police to trigger an armed response at a person's location. Doxxing, reported by a quarter, means publishing names, home and work addresses and phone numbers.
- The organisation restores under pressure. The report states that pressure to resume operations leads businesses to restore services before establishing whether attackers have been removed, leaving unresolved weaknesses for a further intrusion. 69% of respondents suffered multiple successful attacks within the previous year.
- Payment is made. 59% of respondents say their organisation paid. Stated reasons include protecting customer information, limiting disruption, containing reputational damage, and an inability to remove the attacker. The report notes that a decryption key does not remove the need to rebuild to a trusted state, that decryption tools can be buggy or contain malicious code, and that some files may remain unrecoverable.
On identity recovery, half of respondents held dedicated identity backups. The report's argument is that a trusted copy of account and permission data lets teams restore access without carrying compromised settings into the rebuilt environment, and that identity recovery sets the order in which other services can return, because staff need working accounts to use restored applications and administrators need trusted access to manage them.
Attribution is unconfirmed. Beasley names Scattered Spider, ShinyHunters and Lapsus$ as groups he has seen use psychological and physical threats, and separately describes a 2023-era investigation involving Midnight Blizzard in which a package of nesting dolls and regional gifts arrived at his home. These are one consultant's case experience, not a finding of the survey, and no MITRE ATT&CK profile is available for any named group in this item. ShinyHunters told The Register it does "not attack human beings" while acknowledging it pushes corporates "to the absolute limit". Treat all group naming here as anecdotal and single-sourced.
The report also cites Europol and partner investigators flagging 4,340 URLs for removal over the summer in a crackdown on The Com, a loose network whose young members engage in hacking, swatting, digital extortion and physical violence. Beasley's phrase for the commercial model is "violence as a service". That figure comes from The Register's reporting of the Europol action, not from the Semperis survey.
4. Mitigation & containment
P1 within 24 hours
- Write threats against employees and their families into the incident response plan as a named scenario with assigned owners, covering who contacts the affected employee, who liaises with police, and who authorises personal security. The report recommends documenting response roles across the organisation and including procedures for threats against people outside the workplace.
- Establish a named law enforcement contact before an incident. The report advises building the relationship in advance; a swatting call gives minutes of warning, not hours.
- For any organisation currently in recovery: do not restore until the entry point is identified and the attacker's access is removed. Treat restoration as gated on identity remediation, not on service availability.
P2 within 72 hours
- Inventory privileged staff whose personal details are discoverable online (social media, data brokers, corporate directories) and reduce that exposure for identity and domain administrators first, given the 87% identity targeting figure.
- Confirm whether dedicated identity backups exist for Active Directory, Entra ID and Okta, and whether they are isolated from the production identity plane. Half of surveyed organisations had them; assume yours may not until verified.
- Brief the crisis communications and HR functions on doxxing response: what is removed, through which platform contacts, and who speaks to the employee's family.
P3 within 7 days
- Rehearse the restore-order dependency the report describes: identity first, then applications, with a documented check that restored accounts and permissions match a trusted baseline rather than the compromised state.
- Review the decision path to payment. The report gives no evidence that payment restores access, and records that some organisations paid because they could not remove the attacker. Any payment decision should require a documented statement of whether the attacker's access has actually been removed.
- Add a post-incident review item for staff welfare, given the report's account of CISOs leaving roles and staff needing medical or psychological treatment (a quarter of respondents).
5. Indicators of compromise
No indicators of compromise available in the source material. The report describes behaviours rather than atomic artefacts, and no hashes, domains, IP addresses, file paths or command lines are given.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Social media reconnaissance of executives and their families before or during an incident | OSINT exposure of named staff; unusual profile views are not reliably observable, so treat as an exposure assessment rather than a detection | medium |
| Threatening texts, letters or packages sent to employees | Employee reporting channel, mail screening, physical security logs | high (57% of respondents) |
| Swatting calls to emergency services naming an employee's address | Law enforcement contact, physical security incident log | high (23% of respondents) |
| Publication of staff names, home addresses and phone numbers | Brand and dark web monitoring, data broker listings | high (a quarter of respondents) |
| Re-entry through retained backdoors or compromised accounts after restoration | Identity logs (AD, Entra ID, Okta) for authentication from accounts believed remediated | medium; the report states the mechanism but gives no telemetry detail |
6. Detection
Insufficient indicators to author detection rules. The source contains no file artefacts, command lines, registry keys, mutexes or network values to build a rule from, and a rule keyed on survey terminology or group names would detect reporting about the threat rather than the threat.
7. Sources
- Help Net Security, "Ransomware pressure now reaches employees' homes and families", 2026-10-19. https://www.helpnetsecurity.com/2026/10/19/semperis-ransomware-employee-safety-report/
- The Register, "Ransomware gets personal: 'We-know-where-you-are kind of stuff'", 2026-10-14. https://www.theregister.com/cyber-crime/2026/10/14/ransomware-gets-personal-we-know-where-you-are-kind-of-stuff/5302939
- DataBreaches.net, "Ransomware Attacks Intensify: Criminals Shift Focus to Target Employees and Their Families", 2026-10-15. https://databreaches.net/2026/10/15/ransomware-attacks-intensify-criminals-shift-focus-to-target-employees-and-their-families/
All three sources report the same Semperis 2026 Ransomware Risk Report. They are not independent corroboration of its figures. The Register adds case detail from a Semperis consultant interview and the Europol figure; DataBreaches.net summarises the survey.
8. Adverse Trace position
The severity here is organisational, not technical: there is no CVE, no exploitation state and no indicator set to act on, and the 37% figure is a self-reported survey statistic from a single vendor study, so it should be read as a directional signal about attacker behaviour rather than a measured rate. The client impact for EMEA financial services is concentrated in two places the report makes concrete: identity systems were the target in 87% of cases with only half of organisations holding dedicated identity backups, and staff safety now sits inside the incident decision loop, which changes who must be in the room and what must be true before restoration or payment. We assess the physical-threat reporting as credible in direction and unverified in magnitude, and we treat the named groups (Scattered Spider, ShinyHunters, Lapsus$, Midnight Blizzard) as unconfirmed attribution for the purposes of this advisory. Adverse Trace will not issue IOCs for this item because none exist in the source; we will track the underlying Semperis report for any technical annex, and we recommend clients use the P1 items above to test whether their incident plan names a family-threat scenario and a pre-existing law enforcement contact before the next ransomware event, not after it.
Published via PulseTrace — Adverse Trace threat intelligence.