Ransomware criminals are increasingly targeting IT and cybersecurity staff with personal threats to pressure companies into paying ransoms, according to a new report that reveals the alarming human toll of attacks.
Workers, their families and friends are routinely threatened, with almost half of Australian victims seeking medical or psychological help to cope with the harassment.
Fully 19 per cent of Australian ransomware victims in Semperis’s latest Ransomware Risk Report – which surveyed 1,200 IT professionals in nine countries – said they had received physical threats, while 41 per cent had also fielded threats against family and friends.
Around 1 in 4 staff were doxxed during the ransomware attack, while Australian victims reported more personal impact overall than those in other countries – with 26 per cent forced to move from their job, office or home, compared with 14 per cent globally.
Some 35 per cent said they had been ‘swatted’, or reported to authorities for investigation over fabricated offences – compared with 26 per cent globally – while 51 per cent of Australian victims said they hired a security detail, compared with 24 per cent globally.
The stress of the harassment ultimately drove 47 per cent of Australian victims, more than in any other country and nearly twice the 25 per cent global average, to seek medical or psychological help.
“Cybersecurity incidents have been around for a long time now,” Semperis ANZ enterprise sales director Nick Lowther told Information Age, “but the fact that it’s now turning into more serious criminal activity is really quite alarming.”
“I don’t know that people are talking about it as much as they probably should be, and we don’t hear the stories openly about people getting packages on their doorsteps or threatening text messages,” he continued.
Interviews with ransomware victims about their experiences had drawn out a broad range of anecdotes about ransomware gangs’ modus operandi, Lowther said, noting that “this is not an aspect of the job that a lot of people are often thinking about.”
“The threat against a company’s data is not always a strong enough incentive for the business to pay.”
Collateral damage in a silent war
Australian companies are playing catch-up in a world of rising ransomware threats, with ransomware attacks soaring in recent years and average ransom payouts increasing rapidly, with one recent Australian Cyber Network report pegging average losses at $1.35 million.
Ransomware groups like Qilin, The Gentlemen and ShinyHunters continue to fete their conquests, with recent Australian victims including Bathurst RSL, Chadwick Switchboards, Gelatissimo, the Thorndale Foundation, and Campbelltown Anglican Schools Council.
Semperis outlines the impact of ransomware attacks on staff and their families. Image: Semperis.
Ransomware was involved in 22 per cent of the 302 cybersecurity incidents reported to the Office of the Australian Information Commissioner (OAIC) during the first half of 2026, new notifiable data breaches (NDB) statistics have shown, confirming its continued escalation.
Emboldened cybercriminals are aiming bigger and scoring more, with the OAIC reporting a record number of breaches affecting over 1 million individuals – 11 during the first half of this year, compared with just four during the same period in 2025.
Perhaps because Australian victims were more likely than others to pay up, cybercriminals are hitting them where it hurts – striking during much-needed and often under-staffed holiday periods far more often in Australia than in the other countries.
Australians also reported more onerous consequences, with half of ransomware attacks reportedly leading to layoffs, resignations or dismissals – nearly twice the 28 per cent global figure.
Many Australian respondents fingered a lack of defined roles and responsibilities for the damage, blaming outdated, legacy systems or technical debt for enabling the initial attack and 84 per cent saying they had been successfully attacked multiple times.
Pushed to breaking point
Yet behind the headline numbers about prevalence and cost, the figures about human impact are a sobering reminder that the attacks extends far beyond the boundaries of the companies – with already burnt-out tech workers and cyber specialists pushed to the brink.
“IT and cybersecurity staff are already dealing with high levels of stress, but a ransomware attack takes that to a whole new level,” Semperis senior incident response consultant Tim Beasley said.
“I've seen CISOs literally say, ‘I'm out, I'm done, I can't do this. It isn’t worth it’ – and I've seen people walk out the door because leadership thought they mismanaged something that caused the breach to occur. It all takes a mental toll.”
The figures are a counterpoint to conventional wisdom around paying ransoms, with governments in Australia and elsewhere urging companies not to pay up and laws requiring all but small companies to report payments within 72 hours from last May.
Latitude Financial famously refused to pay the ransom demanded by its attackers, but repeated independent studies show that, especially in Australia, most companies do pay up in the end – with businesses worried about downtime and staff worried about their loved ones.
Contemporaneous to the survey, Semperis has funded the production of a documentary called Midnight In the War Room that showcases the lived trauma of a range of cybersecurity staff; it premieres this week and will be available for streaming.
It’s a sobering watch, Lowther said, and a reminder that when cybercriminals make personal threats “it’s no longer just part of the company – they are releasing information about you and it could be anything – personal images from a phone, information from a security camera or a fridge.”
“They’re looking at your baby or your children sleeping – and if you’re a CISO and you get an email with a video of your child sleeping in their cot, it goes extreme level and you’re going to do what you can do to get that money to them.”
The ACSC and police bodies were contacted for comment about the reports of criminal behaviour but had not responded by the time of publication.
