Ransomware Got Personal: When Extortion Means a Package on Your Doorstep

This is an analysis of third-party reporting. The figures below come from Semperis’s annual Ransomware Risk Report as covered by The Register (Jessica Lyons, 14 October 2026). We did not run the survey; read the numbers as one vendor’s self-reported data from organisations that were already breached.

The short version

Ransomware’s centre of gravity has moved. The early model was technical: encrypt the data, sell back the key. Then came double extortion (steal first, then encrypt) and the leak site. The 2026 reporting describes a third turn — coercing the people. According to Semperis’s survey of 1,200 organisations hit by ransomware in the first half of 2026, 37% of attacks involved psychological or physical threats against staff: 23% psychological intimidation and 17% explicit physical threats.

What the survey reported

• 25% were doxxed — personal details (home and work addresses, phone numbers) posted publicly.
• 23% experienced swatting — a bogus emergency call (bomb or active-shooter report) made to trigger an armed police response at a home.
• 24% hired personal security teams in response.
• 25% sought psychological or medical treatment after an incident.
• 53% said attackers carried through on threats in the past year. Reported follow-throughs: threatening texts, letters or packages (57%), threats against family or friends (37%), physical intrusion (19%), abduction (17%), bodily harm (13%), stalking (6%).

The incident responder quoted, Semperis’s Tim Beasley — previously lead investigator on Microsoft’s Detection and Response Team — describes a gift package turning up at his home mid-investigation ("we-know-where-you-are kind of stuff"), executives sent photographs of their children’s schools, and what he calls "violence as a service." He attributes these tactics to well-known groups including Scattered Spider, ShinyHunters and Lapsus$. ShinyHunters, for their part, told The Register they "don’t attack human beings," while admitting they sometimes "push the corporate to the absolute limit."

Read the numbers with care

This is a single vendor’s self-reported survey of a population that was, by definition, already compromised. It tells you what ransomware victims experienced, not the base rate across all organisations, and the characterisations are the respondents’ own. The value is in the consistent direction across many of the figures, not in any one percentage. Held that way, the signal is hard to dismiss: coercion of individuals is now a routine part of the ransomware business, not an outlier.

Why this changes the playbook

If extortion now targets people, the response plan has to as well. Most ransomware runbooks are built around systems — isolate, eradicate, restore, notify. The human-coercion turn adds a second track that most plans barely mention:

• Duty of care is now an IR requirement, not an HR courtesy. If a quarter of victims sought medical or psychological treatment and a quarter hired personal security, "support affected staff" needs a named owner, a budget line and a procedure — before an incident, not during one.
• Decide the pay/no-pay posture in advance. The reporting is blunt: 69% of victims were hit again within 12 months and 31% paid more than once. Paying under duress, when an executive’s family is being threatened, is the worst possible moment to decide policy. Decide it at the board, in writing, with counsel, while calm.
• Plan for doxxing and swatting specifically. Pre-brief local law enforcement that a swatting call may be used against named executives; have a takedown and identity-protection path ready for doxxed staff; keep home-address exposure for key people low as a standing control.
• Involve law enforcement early. The advice in the reporting is to call the FBI (or local equivalent) sooner rather than later, and not to negotiate alone under threat.
• Put human-coercion scenarios in the tabletop. Rehearse the call where a threat names someone’s child, not just the one where a server is down. The decisions are different, and the first time your leadership meets them should not be live.

Where PlayCISO fits

Two of our free, browser-based tools map directly onto this:

• Ransomware Readiness — score your preparedness across prevention, detection, response and recovery, including the decision-making and communications gaps that human-coercion attacks exploit.
• IR Playbook Lab — sequence an incident response correctly (image before wipe, eradicate before restore) and practise the order of operations under pressure.

And for a reminder that no organisation is exempt from this — including the firms that sell security — see the Consultancy Cyber Breach Index, which tracks the documented ransomware and extortion history of the ten largest advisory firms.

Reporting: The Register, 14 October 2026, on Semperis’s annual Ransomware Risk Report (global survey of 1,200 ransomware-affected organisations, H1 2026). Figures are self-reported by surveyed victims. Nothing here is legal advice; ransom-payment decisions carry legal and sanctions-compliance implications and belong with counsel and law enforcement.