Ransomware Groups Now Threatening Physical Violence Against Employees: What Organisations Need to Consider

A new report covered by Infosecurity Magazine warns that ransomware groups are increasingly using threats of physical violence against employees as a tactic to pressure organisations into paying ransoms. Rather than limiting their leverage to data exposure or operational disruption, attackers are now directly threatening the personal safety of staff members — including executives and, in some cases, their families. The tactic is designed to create a sense of personal urgency that bypasses an organisation's normal incident response process and compels faster, less considered payment decisions.

Why this matters for UK organisations

This development represents a meaningful shift in the ransomware threat landscape that has implications well beyond the technical. Incident response plans have traditionally focused on technical recovery, business continuity, legal obligations and external communications — but the introduction of personal safety threats creates a new dimension that involves HR, physical security, employee welfare and potentially law enforcement engagement at a much earlier stage. Staff who receive direct threats may be frightened and may act outside of established processes, potentially making decisions — including making contact with attackers or agreeing to payments — that complicate the organisation's overall response. There is also a clear duty of care dimension: UK employers have legal and ethical obligations to protect the welfare of their staff, and those obligations do not pause during a cyber incident. Organisations that have not considered this scenario in their planning may find themselves unprepared at a moment when clear, calm guidance is most needed.

What to review

UK organisations should review their ransomware incident response plans to confirm they address the human and welfare dimensions of an attack alongside the technical ones. Key questions include: does your plan identify who is responsible for employee communications and welfare during an incident? Does it include guidance for staff who receive personal threats? Is there a clear escalation path to HR, physical security and senior leadership? Organisations should also ensure that early engagement with law enforcement — including the National Crime Agency and, where relevant, the NCSC — is built into their response process. Employees should know in advance that they should report any personal threats immediately to a named internal contact rather than attempting to handle them independently.

Source: Infosecurity Magazine