Ransomware Gangs Embrace Physical Threats, Family Stalking?

Organizations are reporting that employees face threats to their families, stalking, physical violence, and abduction. But these alarming claims are hard to verify.

Ransomware actors have been threatening their victims with physical violence, according to new survey data. Many are reporting actual physical attacks being carried out in service of ransomware extortions, though hard data substantiating these claims is missing.

A combined two out of every five organizations that participated in Semperis’s newly released 2026 Ransomware Risk Report indicated they had faced intimidation and threats associated with their ransomware attacks, and often severe ones. Even more remarkably, more than half of respondents claimed that attackers “carried through on threats” they made.

Semperis’s study relied on self-reporting, and it couldn’t corroborate these alarming figures, nor could Dark Reading. If true, the data suggests that ransomware is escaping the digital realm and becoming a genuine risk to victims’ safety. Unless and until proven cases of violent attacks surface, however, the data must be met with caution.

Orgs Say Employees Are Being Assaulted

It was last year when the realization first hit: Semperis started asking survey participants about physical threats to their organizations in its 2025 annual report, and a full 40% of participants said yes, they had received such threats from their hackers.

This year’s data casts some confusion around the matter, as only 17% of 2026 respondents told surveyors that they’d been subject to physical threats. A further 23% reported psychological intimidation.

Among personal threats, threatening texts, letters, or packages (57% of those who reported being threatened in the first place) were most commonly experienced. Attackers also went much further, though, by threatening employees’ family and friends (37%), physical intrusion into an organization’s facilities (19%), abduction (17%), bodily harm (13%), and stalking (6%).

Worst of all, perhaps, is that 53% of survey respondents reported that their attackers actually carried out their threats.

Interestingly, these figures varied significantly between countries and industry verticals. In the UK, Semperis found that around 34% of ransomware groups’ threats were carried out, and that victims might expect to be stalked 18% of the time. Hackers operating in Italy are exceptionally violent, apparently, as 32% of victims there were threatened with abduction and 22% with bodily harm, with 74% claiming that their threats were carried out.

Attackers have been finding other ways to make ransomware personal issues for their victims, too. According to Semperis, victims or their families were doxxed, swatted, or subjected to some other sort of public shaming in more than half of all cases.

Are Threat Actors Actually Physically Harming People?

Asked whether ransomware victims are actually being physically harmed, Jeff Wichman, Semperis’s director of incident response, states, “Yes. In some way, shape, or form, it does happen.”

In reporting this story, however, Dark Reading failed to find even a single documented case of violence perpetrated in service of a ransomware attack. Asked for a case study, Semperis pointed to a Europol press release regarding so-called “violence-as-a-service,” but Europol did not connect violence-as-a-service with ransomware. However, there is hard evidence that violence in cyberattacks exists in related ways.

First, physical violence is rife and increasing around cryptocurrency thefts. Back in February, Web3 security company CertiK Skynet published its annual report on so-called “wrench attacks.” As the name implies, “wrench attack” is the cryptocurrency world’s term to describe when attackers physically assault their targets in order to steal their cryptocurrency wallet private keys. CertiK Skynet documented 72 cases in 2025, which represented a 75% rise over 2024. Chainalysis found a similar “surge” of wrench attacks in 2025. Halfway through 2026, it found that violent attackers had successfully won $30 million worth of crypto.

What’s true of cryptocurrency is not necessarily true of enterprise cyberattacks, of course. But cyber extortion groups do appear to dabble in physical intrusion. In spring 2026, the FBI and Mandiant researchers each documented the “Silent Ransom Group” posing as IT technicians to enter corporate offices and extract data from endpoints using USBs.

Lastly, it does seem the case that threats of violence are rising across online attacks generally (if not ransomware specifically). In its Internet Crime Report 2025, the FBI reported having received 1,360 complaints involving threats of violence, in cases that did not involve extortion. In 2025 it received 4,826 — a 250% rise year over year.

Why Hackers Turn to Physical Threats

Semperis has had firsthand experience with ransomware groups’ threats. A few years ago, while representing a US government organization in a ransom negotiation, one of its own employees received a package on his doorstep with a note “alluding to physical violence if he didn’t back off,” the BBC reported.

Ironically, a rise in physical threats could be interpreted as a byproduct of improved organizational cybersecurity. “As attackers lose leverage with [extortion] — companies now are in the position of ‘we’ve got this and this covering us’ — now it’s more about forcing that demand. ‘You need to talk to us. We are serious,'” Wichman says.

“It will keep evolving just like anything else,” he continues. “I look at it kind of like the days of the mafia. Originally, it was just about extorting money from businesses. Then it became: You didn’t pay us, now we’re going to get violent. Same old, same old.”