Ransomware attacks are becoming increasingly aggressive, with cybercriminals adopting new methods to pressure organizations into paying substantial ransoms. In addition to encrypting critical files and disrupting business operations, attackers have increasingly relied on double and triple extortion tactics to force victims to meet their financial demands. These tactics can involve stealing sensitive data, threatening to publish confidential information, and targeting additional parties connected to the victimized organization.
However, emerging research suggests that ransomware groups are expanding their strategies beyond businesses themselves. In a concerning development, cybercriminals are reportedly threatening the families of employees working for targeted organizations, using intimidation and harassment to increase pressure on companies to pay the demanded ransom.
According to the Semperis 2026 Ransomware Risk Report, approximately 25% of respondents reported that their employees or family members had faced threats involving doxing and swatting. These findings highlight the growing personal risks associated with ransomware incidents, demonstrating how cyberattacks can extend beyond corporate networks to affect the safety, privacy, and well-being of employees and their loved ones.
Doxing involves collecting and publicly exposing an individual’s private or identifying information, such as a home address, telephone number, or other personal details, without their consent. Cybercriminals can use this information to intimidate victims, facilitate harassment, or threaten their families. Such tactics can create significant emotional distress and raise concerns about the potential for real-world harm.
Swatting represents another particularly dangerous form of cyber-enabled harassment. It involves making a false emergency report to law enforcement or emergency services, claiming that a serious incident, such as a shooting, murder, robbery, or hostage situation, is taking place at a particular address. The objective is to provoke an armed or urgent police response to an unsuspecting victim’s home or workplace.
Attackers may use voice-over-internet-protocol (VoIP) services, spoofed caller identification, and other techniques to conceal their identities or make their communications appear to originate from another source. When emergency responders act on these fabricated reports, innocent individuals can face frightening encounters and potentially life-threatening situations.
The reported use of doxing and swatting in ransomware-related extortion underscores the need for organizations to strengthen cybersecurity measures while also protecting employees’ personal information. Businesses should establish incident-response plans, provide guidance on reporting threats, and coordinate with law enforcement when necessary.
Ultimately, ransomware is no longer solely a matter of data encryption or financial loss. The growing use of personal intimidation demonstrates how cybercriminals can exploit human vulnerabilities, making comprehensive cybersecurity preparedness and employee protection essential.
Join our LinkedIn group Information Security Community!
