Hoboken – October 14, 2026 -- Threat actors weaponized artificial intelligence in 87% of ransomware attacks, and 40% of attacks involved psychological or physical threats against staff, according to the 2026 Ransomware Risk Report published by identity-focused cyber resilience company Semperis. The study surveyed only organizations that were hit by ransomware gangs in the past 12 months.
Attackers followed through on 53% of threats against employees
Bad actors used psychological intimidation in nearly 25% of all attacks across the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada and Australia. In 53% of cases, victims reported that the hackers carried out their threats.
The personal toll was measurable: 23% of victims or family members were swatted, 25% of victims sought psychological and medical treatment, and 24% of victims or families hired personal security.
Tim Beasley, Semperis Senior Incident Response Consultant, said he has seen CISOs quit after breaches, and staff leave when leadership blamed them for causing an incident.
Nearly 70% of victims were attacked more than once
In nearly 70% of attacks, victims were targeted multiple times, and 31% made multiple payments to attackers.
Semperis CEO Mickey Bresman traced the tactical shift from data encryption to double extortion, which pairs encryption with data theft and threats to expose or sell the data. He said the pattern shows attackers will keep looking for new ways to make victims pay.
Identity systems were targeted in 87% of attacks, but recovery readiness lags
Attacks targeted identity systems such as Active Directory (AD), Entra ID and Okta in 87% of cases. Separately, nearly 75% of successful ransomware attacks targeted or exploited the identity system.
Preparedness has not kept pace. Only about half of surveyed companies have dedicated identity backups, automated identity recovery solutions and identity-specific crisis response procedures. Just 50% maintain dedicated identity backup systems, and fewer than half automate identity system recovery. In 40% of organizations, disaster recovery or crisis response plans omit procedures for AD recovery.
Chris Inglis, the first U.S. National Cyber Director and a Semperis Strategic Advisor, said attackers aim to make the cost of resisting greater than the cost of paying, and that identity is the core issue in every insider-style compromise.