Cybercriminals have crossed the line separating the digital world from the physical one and are now targeting corporate chief information security officers (CISOs) and their families with bodily harm and even abduction.
Alarmingly, the majority of ransomware attackers carried through with their threats. According to Semperis's annual global ransomware report from the US-based resilience and crisis response company, 17 per cent of ransomware attacks were accompanied by physical threats against key staff members and/or their families.
Attackers play as dirty as they need to
According to Sarah Gosler, head of cyber resiliency and human defense at US financial services company Wells Fargo: "Attackers play as dirty as they need to get what they want. That's why they're taking it beyond just a company's operation and making it personal. We need to start thinking about cyber attackers as the criminals that they are. Would it surprise you if a criminal physically intimidated somebody? No."
Over half of threats — 53 per cent — against staff were actually carried out, according to Semperis. In addition to physical threats, which were present in 17 per cent of ransomware attacks, bad actors are also threatening psychological intimidation in almost a quarter, 23 per cent, of attacks. This escalation of tactics reflects a broader pattern documented in our earlier coverage of cybercrime getting physical, as criminal groups pursue increasingly aggressive methods to extract payment.
The pressure falls hardest on security leadership. As we have previously reported, CISOs already suffer super stress levels from the weight of their responsibilities — the addition of personal physical threats represents a significant further escalation.
Key staff threatened with abduction
"People are becoming almost desensitized to their data being stolen or shared. That's where the growth of psychological and physical threats is coming from: Other levers just aren't as effective anymore for threat actors, so they're adopting even more nefarious tactics," says Courtney Guss at Semperis Crisis Management.
The Semperis annual report also highlights some national variations in the level of intimidation used against key staff members, which often reflect the existing practices of local criminals. For example, in Italy, where mafia gangs have long operated, 32 per cent of companies attacked saw key staff threatened with abduction and 22 per cent with bodily harm. Disturbingly, 74 per cent of these threats were carried out.
Criminal syndicates embrace both cyber and physical harm
"Ransomware has proven to be a great cash-generating activity for criminal syndicates, which have no hesitation about inflicting both cyber and physical harm," says Semperis CEO Mickey Bresman.
The findings underscore how ransomware has evolved from a purely technical crime into something far more dangerous. The AI-enabled ransomware boom has already lowered the barrier to entry for attackers, while AI-powered ransomware continues to grow in sophistication. The addition of physical coercion to the criminal toolkit signals that ransomware operators are determined to extract payment by any means necessary — and that cyber resilience planning must now extend beyond firewalls and into the physical safety of key personnel.
