Ransomware gangs used AI in 84% of attacks, and a quarter of victims sought medical help

For ransomware victims, the damage described in a new survey extended into employees’ homes and health. Semperis found that 25% of victims sought psychological and medical treatment, while 24% hired personal security for themselves or their families.

The cybersecurity firm published its 2026 Ransomware Risk Report on Wednesday, 14 October 2026. It found that artificial intelligence was involved in 84% of ransomware attacks reported by surveyed victims.

The survey covered organisations in the U.S., U.K., France, Germany, Italy, Spain, Singapore, Canada and Australia. It included only organisations victimised by ransomware gangs in the past 12 months, drawing on 1,200 information technology and security professionals across eight industry sectors.

In 44% of cases, criminals turned the target organisation’s own AI agents or systems against it.

Attackers also brought pressure directly to staff. Psychological or physical threats against employees featured in 40% of attacks, and 53% of victims said hackers carried out those threats.

Sustained threats led employees or family members to relocate their homes, change jobs or move to different office locations at 14% of organisations, the report said.

Identity systems were a central target. The survey found that 87% of attacks went after systems including Active Directory, Entra ID and Okta, while only 50% of companies maintained dedicated backups for identity systems.

Many organisations also faced continued extortion. Some 69% of victims reported repeat attacks, and 31% said they had made multiple payments to attackers.

Chris Inglis, Semperis’s strategic adviser and the first U.S. National Cyber Director, served under former President Joe Biden. He said autonomous ransomware attacks are already part of the threat landscape.

Inglis warned that AI can automate intrusions, find weaknesses in systems and tailor social-engineering schemes to particular employees. He also said the technology can help criminals impersonate organisations by copying their voices, cadence and language, making it harder to establish who is behind an attack.

Courtney Guss, Semperis’s associate vice president of crisis management, said autonomous AI agents can create security weaknesses and may eventually compromise identity systems.