Ransomware: 37% of employees and their families threatened

Ransomware: 37% of companies face threats to employees' families

The 2026 Ransomware Risk Report by Semperis reveals that 37% of organizations affected by ransomware attacks have seen threats extended to employees' family members or friends. The study, based on 1,200 IT and security professionals from companies victimized by attacks, documents a concerning shift in criminal tactics towards the personal sphere.

Quick Response

Criminal Tactics: From Physical Threats to Doxxing

Cybercriminals are intensifying psychological pressure with tactics including threatening messages, stalking, and false emergency reports ("swatting"). 25% of organizations had to provide medical or psychological support to employees or family members. Some cases led to the need for physical protection or changes of residence.

Psychological Impact on Security Teams

The pressure on IT and security staff reaches critical levels during attacks. 59% of companies paid the ransom, often to protect customer data or limit reputational damage. However, payment does not guarantee data recovery and can leave vulnerabilities open.

Vulnerabilities in Recovery Processes

69% of companies experienced multiple attacks in the previous year. The rush to restore operations can lead to re-enabling unsafe access, leaving doors open for new attacks. 50% of organizations had dedicated backups of identity systems, but many recovery processes do not account for changes in permissions.

Identity Systems: The Privileged Weak Point

87% of attacks targeted identity systems such as Active Directory, Entra ID, and Okta. Control of these systems allows criminals to access connected services, modify privileges, and hinder recovery. Restoring user accounts requires a methodical approach to avoid importing compromised configurations.

Barriers to Effective Response

Organizations cite technical and organizational challenges as major obstacles to responding to attacks. Among these are outdated crisis plans, undefined roles, and communication gaps between teams. Identity management emerges as a critical but often overlooked element in recovery processes.

The Importance of a Structured Approach to Cyber Insurance

The complexity of modern attacks requires cyber insurance that covers not only direct financial losses but also indirect costs related to breach remediation and psychological support. Policies must include coverage for threats extended to employees and their families, an increasingly relevant aspect in the current landscape.

Incident Response: Why a SOC as a Service Makes a Difference

In the face of such evolved threats, the importance of a managed Security Operations Center becomes evident. A MDR service (Managed Detection and Response) can provide the 24/7 response capability needed to address complex attacks, while a managed SOC ensures access to specialized skills without the costs of a dedicated internal team.

Compliance: The Role of ISO 27001 Certification

Compliance with ISO 27001 standards emerges as a crucial factor for business resilience. A valid certification not only demonstrates a commitment to security but also structures incident response processes more effectively. In particular, periodic security audits can identify vulnerabilities in identity systems before they are exploited.

Future Perspectives: The Evolution of Threats

Organizations must prepare for increasingly sophisticated threats that combine technical and psychological tactics. The adoption of zero trust architectures and advanced identity management (IAM) are essential steps to protect both corporate and personal environments of employees.

Legal and Insurance Considerations

Companies must review their cyber risk policies to ensure they cover new forms of digital extortion. Particular attention should be paid to coverage of costs related to incident response and psychological support for affected employees.