The Ransom Note Now Names Your Family
Three hours into the incident, a phone buzzed with a text from a number nobody recognized. The message did not ask for money. It named the chief information security officer's daughter, it named her school, and it gave the time she usually got dropped off in the morning. Then it went back to the ransom. The chief information security officer is the executive who owns security for the whole company, and that person had spent three hours thinking about servers and backups. The text was not about servers.
That scene is no longer rare. This week Semperis published its 2026 Ransomware Risk Report, built on a survey of 1,200 security and IT professionals, and the number that stops you is this. At 37 percent of the organizations that got hit, the attackers threatened employees' family members or friends. Not the company. The people who work there, and the people those people go home to.
Most of the coverage will file this under ransomware and move on. That misses what actually changed.
Extortion stopped targeting data and started targeting people
For a long time ransomware was a math problem for the attacker. Lock up the files, demand a price to unlock them, and the leverage was the data. Then crews added a second step. They stole the data before they encrypted it, so they could also threaten to publish it. The industry called that double extortion, meaning two forms of pressure stacked on one victim, the lockout and the leak.
What the Semperis number shows is a third step, and it is a different kind of thing. The leverage is no longer the data at all. The leverage is fear, aimed at a specific human being, delivered through the people that human loves. A crew that names your child's school is not trying to make a technical argument about your backups. It is trying to make the person with the authority to pay stop reasoning like a security professional and start reacting like a parent. That works. It works precisely because it bypasses every control the company bought, since none of those controls sit between an attacker and a family.
Here is the part the reports skip. The attacker had to get that information from somewhere, and getting it was not hard. The name of the school, the drop off time, the spouse's employer, the home address behind a limited liability company, all of it sits in public records, data broker listings, school fundraiser pages, and the executive's own social media and their kids' social media. Assembling it has a name in our world. It is open source intelligence, usually shortened to OSINT, which means intelligence built entirely from information anyone can legally find. A competent operator can build a target package on a named executive and their household in an afternoon. The crews doing this are competent operators.
This is the seam between the two jobs, and almost nobody staffs it
Walk into most companies and the incident response plan is a cyber document. Incident response, or IR, is the plan for what the company does when it gets breached, and that plan is written by technical people for a technical fight. It covers isolating systems, preserving evidence, talking to counsel, deciding whether to pay. It is usually a good plan for the fight it was written for.
It has no page for the moment the threat walks off the network. When the text names a child, the question on the table is not technical. It is whether a family needs to change its morning routine tonight, whether a school needs to be told, whether anyone should be watching the house. The people in the incident bridge, the call where the technical team runs the response, have no training for that question and no authority to answer it. The company's physical security, if it has any, was never invited to the bridge because this was filed as a cyber event. So the one question that actually frightens the executive is the one question nobody in the room owns.
That gap is not an accident of one company. It is structural. Cyber teams defend systems and have never thought of an executive's teenager as part of the attack surface. Protective professionals understand threats to people and have never sat in on a ransomware negotiation. The attacker reads that split better than most defenders do, and aims straight at it. The threat that starts on a keyboard and ends at a front door lives in the space between the two teams, and in most organizations that space is empty.
The response has to account for the family before anything happens
A plan that takes this seriously cannot stop at the network boundary. It has to assume the attacker will reach for the people, because the data now says better than a third of them do, and it has to be built before the incident instead of improvised in the middle of one.
That starts with knowing what an attacker can already see. Somebody has to run the target package on the senior executives the same way a crew would, using only public information, and lay out what can be assembled about each of them and their household in an afternoon. An exposure nobody has looked at in one place cannot be reduced, and most executives have never seen their own pulled together on a single page.
Then the two plans have to become one. The incident bridge needs a branch that activates the moment a threat turns personal, with a named owner, a decision chain that actually works at 0200, and a protective posture that can stand up around a household on short notice. The negotiation approach has to account for coercion aimed at a person and not just pressure aimed at data, because the two are not answered the same way. A threat to leak files is a business decision that counsel and leadership can weigh. A threat against a child is not a business decision, and a plan that routes both through the same technical checklist is a plan the attacker already knows how to beat.
None of this is exotic. It is ordinary incident response planning and ordinary protective work. What is rare is having both done by people who were in the same room before the event, instead of two teams meeting for the first time while the phone is buzzing.
What you can check yourself this week
You can measure most of this before you call anyone, and the exercise tends to show you how much of it currently has no owner.
Start with one senior executive and build their public picture yourself. Spend an hour with nothing but a search engine and public records. Find the home address, the spouse, the children's names and schools, the regular routines that show up in photos and posts. Do not rationalize what you find as harmless because it is public. Public is exactly what the attacker uses. If an hour gets you a workable picture of that person's household, a crew motivated by a seven figure payout will get more.
Now open your incident response plan and look for the branch that handles a threat against a person. Read it closely. If the plan covers systems, evidence, counsel, and payment, but goes silent the moment the threat names a human being, you have found the hole the Semperis number is describing. Ask who in your organization would make the call to protect an executive's family during an active incident, and whether that person is even on the incident bridge. In most companies the honest answer is that nobody is, because the event was filed as cyber and physical security was never called.
Then ask the question that connects the two. If a ransom negotiation turned personal tonight, who talks to the family, who decides whether to involve local law enforcement, and who stands up protection around a house by morning. If the answer is that the technical team would figure it out in the moment, that is not a plan. That is the attacker's best case.
Work through those three and the shape of the problem comes into focus. This is not a question of a better backup or a cleaner segmentation. It is that defending a company now means someone who understands how attackers coerce people has to be standing next to someone who protects people, before the incident, with a single plan between them. Almost no organization has built that, because almost no provider can.
That is the work we do. We plan and run incident response, and we protect high risk people and their families, so we can look at a ransomware event as both the technical fight on the network and the threat that is going to step off it and aim at a household. We build the target package on your executives the way an attacker would, we write the response plan that already expects the threat to turn personal, and we put a real protective branch inside the incident bridge so the frightening question has an owner before it gets asked. A cyber firm will manage the breach and never see the text about the daughter coming. A protective firm will guard the family and never be in the room where the threat first appears. The attack is built to exploit the gap between those two, and that gap is where we stand.
We're based in Dallas, Texas, and we go wherever the problem is. Red Cell Security provides cybersecurity and physical security consulting to clients across the US and around the world.
Comments