Ransomware attackers target families as artificial intelligence spreads

A global survey has revealed that ransomware attackers are targeting the families of employees while leveraging artificial intelligence in their attacks on corporate systems. Semperis, a cybersecurity company, reported that 37% of affected individuals experienced threats against their relatives or friends, while 84% of ransomware incidents involved the use of AI.

The 2026 Ransomware Risk Report surveyed 1,200 IT and security professionals from organizations affected by ransomware within the past year. The study found that psychological or physical threats against employees were present in over a third of attacks, with threats including messages, letters, packages, harassment, stalking, unauthorized physical entry, and threats of bodily harm.

The consequences of these attacks went beyond disrupted networks, with nearly a quarter of affected respondents seeking psychological or medical treatment, and 24% reporting personal security measures or the involvement of law enforcement. Chris Inglis, a former U.S. national cyber director, emphasized that attackers aim to make resistance to ransom demands more costly than compliance.

The survey also highlighted the growing role of AI in ransomware attacks, with 84% of incidents involving AI usage, although the report did not establish that AI alone caused the breaches. Criminals often exploited AI tools already within victim organizations, such as assistance with malicious communications and other stages of an intrusion.

However, the findings do not indicate that every attack was autonomous or that human operators had ceased directing ransomware campaigns. Identity infrastructure remained a major vulnerability, as 87% of attacks targeted identity systems like Microsoft Active Directory, Entra ID, and Okta. Semperis found that only about half of participating organizations maintained dedicated identity backups and fewer than half had automated recovery capabilities.

Additionally, only 60% of disaster recovery or crisis response plans included procedures specifically addressing identity system restoration. Repeated attacks were common, with nearly 70% of surveyed victims reporting multiple attempts within a year and 31% making multiple ransom payments. The survey also noted that threats against individuals could further pressure victims into paying ransom.

Tim Beasley, a senior incident response consultant at Semperis, noted that the strain on cybersecurity staff could lead to resignations or blame from management. The report was released on October 14, providing a snapshot of reported victim experiences across the United States, Britain, France, Germany, Italy, Spain, Singapore, Canada, and Australia.