Ransomware gangs increasingly use threats and physical intimidation to force payments

Semperis’ annual ransomware risk report reveals that more than a third of ransomware incidents now include psychological or physical intimidation, with 23% involving mental pressure and 17% using physical threats. The survey of 1,200 post-attack organizations recorded a range of coercive actions, including doxxing, forced security hires, swatting calls and even threats of abduction or bodily harm. Victims reported that 57% received threatening texts or packages, and 53% said attackers have actually carried out threats.

Notable threat actors mentioned include Scattered Spider, ShinyHunters and Lapsus$, while Europol’s crackdown on the loosely organized network known as The Com highlights law-enforcement focus on this trend. Experts advise firms to resist paying ransoms and involve law-enforcement early, as repeated payments often lead to further extortion.