Survey Reports Physical Threats by Ransomware Groups, but Claims Remain Unverified
Summary
Semperis's 2026 survey found that some organizations reported physical threats and intimidation tied to ransomware, but the claims were unverified. Dark Reading found no documented case of violence carried out for a ransomware attack.
Key points
- In the survey, 17% of respondents reported physical threats and another 23% psychological intimidation related to ransomware attacks.
- Among respondents who reported threats, common claims included threatening messages, threats against family or friends, and threats of intrusion, abduction, or bodily harm.
- More than half of respondents who reported threats said attackers carried them out, but Semperis relied on self-reports and could not corroborate the figures.
- Dark Reading said it found no documented case of physical violence perpetrated in service of a ransomware attack.
- The article cites related examples, including physical assaults to steal cryptocurrency and Silent Ransom Group members posing as IT technicians to enter offices and extract data.
Article Details
- Publisher
- Dark Reading
- Report Period
- Semperis 2026 Ransomware Risk Report; also discusses findings and incidents from 2025 and spring 2026
- Scope
- Survey-reported physical threats and intimidation associated with ransomware, alongside reported violence in related cybercrime contexts. The article notes that the survey claims could not be corroborated.
- Key Statistics
- In Semperis's 2026 survey, 17% of respondents reported physical threats and a further 23% reported psychological intimidation.
- Among respondents who reported being threatened, 57% reported threatening texts, letters, or packages; 37% reported threats to employees' family or friends; 19% reported threats of physical intrusion; 17% abduction threats; 13% bodily-harm threats; and 6% stalking.
- 53% of survey respondents said attackers carried through on their threats; the article cautions that these self-reported claims were not corroborated.
- Semperis reported that 40% of participants in its 2025 annual survey said they had received physical threats.
- CertiK Skynet documented 72 cryptocurrency-related wrench-attack cases in 2025, a reported 75% increase over 2024.
People
Threat Actors
Vendors
CertiK Skynetviolence is rife and increasing around cryptocurrency thefts. Back in February, Web3 security company CertiK Skynet published its annual report on so-called "wrench attacks." As the name implies, "wrench attack" is theChainalysisprivate keys. CertiK Skynet documented 72 cases in 2025, which represented a 75% rise over 2024. Chainalysis found a similar "surge" of wrench attacks in 2025. Halfway through 2026, it found that violentMandiantBut cyber extortion groups do appear to dabble in physical intrusion. In spring 2026, the FBI and Mandiant researchers each documented the "Silent Ransom Group" posing as IT technicians to enter corporateSemperisA combined two out of every five organizations that participated in Semperis's newly released 2026 Ransomware Risk Report indicated they had faced intimidation and threats associated with their ransomware attacks, and
Countries
Italywere carried out, and that victims might expect to be stalked 18% of the time. Hackers operating in Italy are exceptionally violent, apparently, as 32% of victims there were threatened with abduction and 22% withUnited KingdomInterestingly, these figures varied significantly between countries and industry verticals. In the UK, Semperis found that around 34% of ransomware groups' threats were carried out, and that victims might expect to beUnited States