Ransomware attackers are expanding their pressure tactics

Semperis has released 2026 Ransomware Risk Report. It is based on a survey of 1,200 IT and information security professionals from nine countries and eight industries; the sample included only organizations where at least one ransomware attack had succeeded and disrupted operations.

Because ransomware activity is frequently covered in various reports, the overall statistics and trends are summarized briefly below:

• By country, France, Australia, Italy, and Spain stand out: 100%, 84%, 81%, and 81% of respondents, respectively, reported more than one attack during the year. • By industry, repeated successful attacks were most common in healthcare (82%), transportation (77%), and manufacturing (72%). • Most attacks occur outside working hours; repeated attacks and multiple ransom payments remain common, while attackers typically spend 2–6 days inside the infrastructure.

Let’s take a closer look at how attackers' methods and pressure points are changing:

AI is already having a noticeable impact on ransomware attacks. 84% of respondents encountered attacks in which AI was used in some way: 40% faced attacks involving AI, while 44% experienced attacks targeting their own AI agents or the company's AI systems. The latter is particularly dangerous when such systems have access to other services: attackers can use them to escalate privileges and move further through the infrastructure.

Identity management systems are attacked more often than organizations are prepared to restore them. In 87% of cases, ransomware attackers targeted Active Directory, Entra ID, or Okta. Yet only 50% of organizations had dedicated backups of these systems, and just 42% had automated recovery. The growing role of identity attacks has previously been highlighted by Microsoft, Rubrik Zero Labs and others.

Pressure extends beyond the digital environment and beyond the organization itself. In 17% of attacks, threat actors resorted to physical threats, including abduction and bodily harm. In 37% of cases, the pressure extended to employees' friends and relatives, while about a quarter of organizations faced the publication of employees' and their families' personal data (doxxing) or fake emergency calls to law enforcement (swatting) at their addresses.

Response challenges are often organizational rather than technical. 48% of companies cited the lack of clearly defined roles and responsibilities as an obstacle, while 44% each pointed to problems with coordination between teams and outdated response plans.