News
Semperis: Ransomware Hits AI Systems -- and Employees' Families
Ransomware attackers are exploiting companies' own artificial intelligence systems and extending pressure beyond corporate networks to employees and their families, according to a new Semperis survey of organizations that suffered disruptive attacks.
The company's Oct. 14 announcement highlights findings from its 2026 Ransomware Risk Report, which examines AI-related attack tactics, personal intimidation and recovery preparedness. Censuswide surveyed 1,200 information technology and security professionals across nine countries and eight industry sectors in the first half of 2026.
The sample has an important limit: This year's study included only organizations where at least one ransomware attack caused business disruption. The results describe those victims' experiences, rather than the likelihood that an organization will suffer an attack. The report says that sampling approach changed from previous studies.
Semperis sells identity security, recovery and crisis management products.
AI Is Both a Weapon and a Target
The report says 84% of respondents experienced attacks that exploited AI in some way. Its breakdown distinguishes AI-based attacks, reported by 40%, from attacks that manipulated victims' own AI agents or systems, reported by 44%. That distinction matters: The broader figure covers both attackers using AI and attackers exploiting AI deployed inside an organization.
Defensive use of AI also produced mixed responses. Nearly half of respondents, 49%, said they successfully used AI for detection or response, while 23% said their AI tools failed to detect or respond successfully. Those are survey responses about victimized organizations, rather than a controlled comparison of security products.
[Click on image for larger view.] AI Roles in Ransomware Attacks (source: Semperis).
Chris Inglis, former U.S. national cyber director and a Semperis strategic adviser, described the difficulty of recognizing AI's involvement. "Many attacks are not perceived as being aided and abetted by AI because they're just too slick, too sophisticated," he said in the report.
Pressure Moves Beyond Company Systems
Data erasure, destruction or release remained the most frequently reported threat, at 56%. Blackmail, extortion or public shaming followed at 41%, with system lockouts or operational sabotage at 40%. The report also recorded psychological intimidation at 23% and physical threats at 17%.
[Click on image for larger view.] Threats Used to Pressure Ransomware Victims (source: Semperis).
In its separate breakdown of personal threats, the report lists threatening texts, letters or packages at 57% and threats against staff members' families or friends at 37%. It says 53% of respondents reported that attackers carried through on threats during the past year, without establishing that all those incidents involved physical violence.
The consequences extended beyond the workplace. The report records doxxing -- identities disclosed online without consent -- at 25%, and swatting -- fabricated emergency reports that send law enforcement to a person's location -- at 23%. Medical or psychological treatment was reported at 25%, additional security at 24%, and relocation involving a job, office or home at 14%.
[Click on image for larger view.] Ransomware Impacts on Staff and Families (source: Semperis).
"Attackers don't follow any rules. You're basically going to a gunfight, and you're equipped with a spork," said Sarah Gosler, identified in the report as a cyber resiliency and human defense expert.
Identity Recovery Remains Uneven
For organizations running hybrid and cloud identity services, the report documents a gap between systems targeted and recovery preparations. Attackers targeted or exploited identity infrastructure in 87% of surveyed cases. The chart lists Microsoft Active Directory (AD) at 51%, Microsoft Entra ID at 48% and Okta at 27%.
[Click on image for larger view.] Identity Systems Targeted by Ransomware Attackers (source: Semperis).
Half of surveyed organizations maintained dedicated identity backup systems, and 42% had automated identity recovery solutions. Documented recovery procedures varied by platform: 60% reported AD recovery procedures in disaster recovery or crisis management plans, compared with 52% for Entra ID and 28% for Okta.
[Click on image for larger view.] Identity Recovery Preparations Among Surveyed Victims (source: Semperis).
The report connects these preparations with the ability to recover identity systems to a secure state. It warns that hidden malware and backdoors can reintroduce attackers into a recovered environment and argues for including identity recovery procedures in broader crisis response plans.
Repeat Attacks and Response Gaps
Successful attacks frequently happened more than once. Some 69% of respondents reported multiple successful ransomware attacks: 40% experienced two, 24% experienced three and 5% experienced four. The remaining 31% reported one attack.
[Click on image for larger view.] Repeat Ransomware Attacks Among Surveyed Victims (source: Semperis).
Overall, 59% paid a ransom. Among those who paid, 53% paid multiple times. Reasons for paying included protecting customer data or privacy, minimizing disruption and containing reputational damage; 23% cited an inability to eject the attackers.
Business consequences included temporary disruption or revenue loss and cyber insurance cancellation or rate increases, each reported by 42%. Data theft or destruction affected 36%, while 28% reported layoffs, resignations or dismissals.
Response problems also involved organizational preparation. A lack of defined roles and responsibilities was cited by 48% as a blocker to effective cyber crisis management and response. Cross-team communication gaps and outdated plans each registered 44%. The report calls for updating crisis management plans and closing communication gaps as part of ransomware preparedness.
About the Author
David Ramel is an editor and writer at Converge 360.