Ransomware gangs target employees' families with AI‑powered intimidation

Ransomware attackers are moving beyond encrypting files and threatening to leak data. In a 2026 survey of 1,200 IT and security professionals, 84 % of victims said an AI‑enabled attack was involved, and 87 % said identity systems were targeted. The study covered nine countries and eight sectors, from finance to critical infrastructure.

The same survey found that 41 % of respondents reported physical or psychological intimidation, and 37 % said friends or family of employees had been threatened. One‑quarter of participants said employees or their relatives were doxed, and 23 % said they had been swatted. About 25 % reported that an employee or a family member required medical or psychological care, 24 % hired extra security, and 14 % were forced to change jobs, offices or homes. Chris Inglis, a former U.S. national cyber‑director, warned that such threats shift attention from work to personal safety, creating a powerful incentive to pay ransoms.

Closing the security gaps

Exploiting enterprise AI The report also highlighted that 44 % of respondents experienced attacks that manipulated their own AI agents or systems. AI can speed up reconnaissance, personalize social engineering, and accelerate data processing, giving attackers a sharper target when they gather personal details from social media, data brokers and leaked records.

Experts recommend that CSOs focus on identity security and limit AI permissions. They should enforce two‑factor authentication on privileged accounts, adopt a least‑privilege model, back up identity systems, and test restoration. Devroop Dhar and Courtney Guss advise giving AI agents clear owners, restricting their access, and requiring human approval for high‑impact actions. Companies should also set up confidential reporting channels for intimidation and run tabletop exercises that simulate threatened identity systems and family‑related threats.