Ransomware Groups Increasingly Resorting to Real World Threats

The tactics of ransomware groups are constantly changing to increase pressure on victims to give in to their demands. Initially, file encryption alone was sufficient; however, as victims improved cyber resilience and were able to recover their encrypted files from backups, tactics had to evolve. Ransomware groups incorporated data theft into their attacks and started threatening to sell or leak the stolen data if the ransom was paid. This double extortion approach proved highly successful, with the threat of a data leak alone sufficient to prompt many victims to pay up.

Encryption and data leak threats are no longer enough, as the percentage of victims paying ransoms continues to fall. According to a recent survey commissioned by the Identity Threat Detection and Response (ITDR) firm Semperis, the percentage of ransomware victims paying ransoms has fallen from 78% in 2024 to 69% in 2025, and 59% in 2026.

Ransomware groups have responded by adopting more aggressive tactics, and a trend has emerged of ransomware groups issuing personal threats against company employees and their friends and family members. The survey revealed that 37% of ransomware attacks involved threats against friends or family members of staff members, and 41% of respondents to the survey said they had been a target of physical or psychological intimidation.

Read more: The HIPPA Journal