Ransomware Gangs Escalate Pressure Tactics with Threats Against Executives and Employees

Ransomware gangs are increasingly moving beyond cyber extortion and targeting people directly, using intimidation, harassment and threats against executives and employees to pressure organisations into paying ransom demands. According to the 2026 Semperis Ransomware Risk Report, around a quarter of ransomware attacks now involve psychological or physical threats aimed at CISOs, senior leaders and other staff members.

These tactics form part of what is often described as triple extortion, where attackers not only encrypt systems and steal sensitive data, but also seek to coerce organisations through direct threats against individuals. The report found that 40% of affected organisations experienced some form of psychological or physical intimidation during a ransomware incident, representing a significant increase on previous years.

Common methods include threatening messages, letters or packages sent directly to employees, threats made against family members, and warnings of physical intrusion at corporate offices or private homes. By creating fear and uncertainty, cyber criminals are attempting to increase the perceived cost of resisting their demands, even in cases where an organisation may be capable of restoring systems from secure backups.

The threats are not always empty. Organisations surveyed reported incidents of doxxing, where personal information about employees is published online, and swatting, in which false emergency reports are made to trigger an armed police response at an individual's home or workplace. Among respondents affected by these tactics, 25% reported employees being doxxed and 23% experienced swatting incidents. The consequences can be severe, ranging from psychological distress and counselling requirements to employees relocating following sustained harassment.

This trend highlights how ransomware has evolved from a purely technical threat into one that directly affects the wellbeing and safety of employees. Criminal groups increasingly conduct extensive open-source research before launching attacks, gathering information from social media, professional networking platforms, company websites and previous data breaches to identify and target key personnel.

The UK's National Cyber Security Centre (NCSC) continues to identify ransomware as one of the most significant cyber threats facing organisations. Attackers commonly gain initial access through phishing emails, stolen credentials, weak passwords, unpatched vulnerabilities and compromised remote access services. Once inside a network, they seek to escalate privileges, move laterally and maximise disruption before demanding payment.

To reduce the risk of ransomware, the NCSC recommends maintaining regular, tested and protected backups of critical data, enabling multi-factor authentication on all remote and privileged accounts, applying security updates promptly, restricting administrative privileges and implementing effective monitoring and incident response procedures. Regular cyber security awareness training is also essential, helping staff recognise phishing attempts, social engineering techniques and emerging threats.

As ransomware operators increasingly target individuals rather than just technology, organisations should ensure that incident response and business continuity plans address both the cyber and human impacts of an attack. This includes clear procedures for responding to threats against employees, engaging law enforcement, supporting staff welfare and managing communications during a crisis. The emergence of doxxing, swatting and physical intimidation demonstrates how ransomware groups continue to adapt their tactics in pursuit of financial gain. Organisations that combine strong technical controls with robust support for their people will be better placed to withstand these increasingly aggressive extortion campaigns and protect both their operations and workforce.