Ransomware Groups Are Now Targeting Individuals: What This Means for UK Businesses

A global survey reported by The Register has found that 37% of ransomware attacks now involve psychological or physical threats directed at individuals connected to the targeted organisation. Dark Reading's coverage of the same research notes that organisations are reporting threats to employees' families, stalking behaviour, and in some cases threats of physical violence or abduction. These tactics represent a deliberate escalation by ransomware groups, designed to increase personal pressure on decision-makers — particularly executives, IT staff and incident responders — to accelerate ransom payments or disrupt the organisation's ability to coordinate an effective response.

Why this matters for UK organisations

Traditional ransomware incident response has focused almost entirely on the technical dimension: isolating affected systems, assessing data loss, restoring from backups, and notifying regulators. This research suggests that model is no longer sufficient on its own. When employees receive personal threats during an active incident, the ability of the response team to function clearly and effectively is directly undermined. Individuals who are worried about their own safety or the safety of their families are less able to make sound decisions under pressure, and organisations that have not prepared their people for this possibility are likely to find it significantly more disorienting when it occurs. The human and welfare dimension of a ransomware attack now needs to be explicitly built into incident response planning, not treated as an afterthought.

What to review

Review your incident response plan to confirm it addresses employee welfare and safety, not just technical recovery. Assign clear ownership for the human response — this should involve HR, physical security, legal and employee assistance functions working alongside the technical team. Ensure that key personnel know in advance who to contact if they receive a personal threat during an incident, and that there is a clear escalation path to law enforcement. Brief your leadership team and incident response staff on the fact that this tactic is becoming more common, so that it does not come as a surprise. Preparation and clear communication before an incident are the most effective way to reduce the impact of these pressure tactics when they are used.

Source: The Register