Report by Semperis
2026 Ransomware Risk Report
Key Findings
Bad actors threatened victims with psychological intimidation in nearly 25% of ransomware attacks in the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada, and Australia.
31% of ransomware victims made multiple payments to attackers.
Hackers followed through on threats in 53% of ransomware cases.
23% of ransomware victims or their family members were swatted.
25% of ransomware victims sought psychological or medical treatment following the attack.
24% of ransomware victims or their families hired personal security after an attack.
Overall, 40% of ransomware attacks involved psychological or physical threats against staff.
In nearly 70% of ransomware attacks, victims were targeted multiple times.
Nearly 75% of successful ransomware attacks targeted or exploited identity systems.
Only 50% of companies maintain dedicated identity backup systems.
40% of organizations' disaster recovery or crisis response plans do not include procedures for Active Directory recovery.
In 87% of ransomware attacks, threat actors weaponized artificial intelligence.
87% of ransomware attacks targeted identity systems such as Active Directory, Entra ID, and Okta.