Semperis survey documents doxxing and swatting in ransomware extortion

Ransomware attackers are using threats against employees alongside encryption and stolen-data exposure to press companies for payment, according to Semperis's 2026 Ransomware Risk Report, published October 14. Among organizations affected by these intimidation tactics, 25% said staff had been doxxed and 23% reported employees had been swatted. The research surveyed 1,200 IT and security professionals across North America, the UK, Europe and the Asia-Pacific. Reported consequences included psychological treatment for employees and, in some cases, victims moving home. Such pressure can encourage payment even when companies can restore their networks from backups.