The 2026 Semperis Ransomware Risk Report, based on a survey of 1,200 IT and security professionals across nine countries and eight industry sectors, highlights the growing complexity of ransomware attacks and the challenges organizations face in recovering from them.
The 2026 Ransomware Risk Report offers an extensive view into the activity and business impact of ransomware around the world.
The Semperis’ 2026 Ransomware Risk Report studies organizations that experienced at least one successful ransomware attack. The 2026 report provides visibility into the state of ransomware and related risks to both business continuity and employee well-being.
The report explores interconnected factors including AI’s involvement in threat escalation and attack timing, frequency, and payment trends; attacker tactics; operational resilience levels; and crisis management challenges.
Key Findings
69% Multiple attacks (and multiple payments) continue.
69% of surveyed ransomware victims were targeted multiple times within the past 12 months;
31% made multiple payments to attackers.
37% Attackers increasingly threaten victimized companies’ staff and their families.
37% of attacks involved threats not just against operations or company staff but against employees’ friends or family members. In addition,
41% of respondents said they had been the target of physical or psychological intimidation.
84% AI is changing the ransomware landscape.
84% of attacks weaponized artificial intelligence in some way.
87% Identity infrastructure continues to be a prime target as identity recovery preparation lags.
87% of ransomware attacks targeted identity systems like Active Directory (AD), Entra ID, and Okta. But only about half the companies we surveyed have dedicated identity backups, automated identity recovery solutions, and identity-specific crisis response procedures.
87% of ransomware attacks targeted identity systems
Ransomware = Big Business
Attackers continue to hit hard, fast, and frequently; most organizations continue to pay up.
Assume breach position
Ransomware (and other types of cyberattacks) have become endemic, and although maintaining a strong security posture is vital, there’s no such thing as a foolproof defense.
Attackers Continue to Focus on Times of Distraction
Bad actors strike when companies are most likely to miss their initial entry into the environment. Although 38% of attacks occurred during regular operating hours, evenings and weekends were by far the most dangerous times, with 79% of respondents noting attacks then. And 14% happened during the chaos that often accompanies material corporate events: mergers or acquisitions, IPOs, or mass staffing changes.
Why do companies continue to pay?
Unsurprisingly, a desire to minimize damage to the business, its reputation, and its customers are leading reasons. However, nearly one quarter (23%) of respondents paid because they could not remove the attackers from their environment.
Evolving Tactics and Escalating Threats
AI enters the attack chat, and bad actors are expanding their threats beyond the business environment.
- AI was exploited in some way in more than four fifths of attacks.
- Data destruction, business extortion, and system lockouts continue to be the most prevalent threats.
- Attack tactics are becoming more personal, extending beyond the business to include threats against staff members’ families or friends in more than one third of cases.
- Attackers followed through on their threats in more than half of reported cases.
Threats Extend Beyond Cyber
When it comes to ransomware leverage, data erasure, destruction, or release is still the most popular threat (56%), followed closely by blackmail or extortion (41%) and system lockouts or sabotage (40%). But cyber criminals aren’t stopping at the digital ecosystem.
Bad actors are also threatening psychological intimidation (23%), physical threats (17%), and legal exposure (10%) to guarantee payment. They are targeting executives, staff, and even the families of their victims. Although criminals in some regions are still focused on “traditional” ransomware, more-personal threats are quickly gaining traction
Top Ransomware Risks: Data, Revenue, and Insurability
Victimized organizations also experienced cyber insurance cancellation or rate hikes 42% of the time. Overall, data theft or destruction (36%) was also a prevalent concern. However, only about half as many companies experienced this consequence compared with last year.
Job losses following ransomware attacks were dramatically lower this year — 28% overall, compared with 62% last year. Still, this disruption was present in more than one quarter of organizations.
The Personal Cost of Ransomware
Organizations are used to weighing the business risks of a ransomware attack. Some of these risks, such as staff reductions, obviously affect the real people behind the corporate entity. Those negative effects are now spreading to people outside the company, including not just staff but their families.
The Identity Crisis Continues
Despite being a top attack target, the identity infrastructure remains at risk in most organizations.
Active Directory (AD) was the target in more than half (51%) of these cases, followed closely by Entra ID (48%). More than one quarter (27%) of respondents also experienced Okta breaches.
Only about half the organizations in the study reported having documented recovery procedures for their AD (60%) or Entra ID (52%) systems. Even fewer (28%) had documented the steps to recover Okta. Even — or perhaps especially — without identity-recovery automation, the inclusion of identity attack response procedures in crisis response and disaster recovery plans is crucial to identity and operational resilience.
Identity Recovery Must Become a Core Part of Ransomware Resilience
The 2026 Semperis Ransomware Risk Report reinforces an important cybersecurity reality: preventing ransomware is essential, but the ability to recover securely determines how quickly an organization can restore business operations.
Identity infrastructure sits at the centre of modern IT environments. Active Directory, Microsoft Entra ID, and other identity platforms control access to applications, cloud services, infrastructure, and sensitive business information. When attackers compromise these systems, the impact can extend across the entire organization, potentially undermining both security controls and recovery efforts.
The report’s finding that 87% of surveyed ransomware victims experienced attacks targeting identity infrastructure is especially revealing. Yet only half maintained dedicated identity backups, revealing a substantial gap between the systems attackers target and the recovery capabilities organizations have established.
Four Priorities for Stronger Ransomware Resilience
At Reputiva, we recommend four practical steps to strengthen ransomware resilience:
- Strengthen Identity Security: Enforce MFA, least-privilege access, privileged access controls, and continuous identity monitoring.
- Prioritize Identity Recovery: Maintain secure identity backups, documented recovery procedures, and regularly tested restoration processes.
- Address AI Security Risks: Govern AI agents, monitor their permissions, and enforce appropriate access controls.
- Test Operational Resilience: Conduct incident response exercises, define responsibilities, and establish alternative communication channels.
For small and medium-sized businesses (SMBs), a risk-based approach helps prioritize critical security investments despite limited resources.
The goal is not just to prevent ransomware attacks, but to recover securely and minimize business disruption.
Is Your Organization Prepared to Recover from an Identity-Based Ransomware Attack?
Ransomware resilience requires more than backups and endpoint protection. Organizations need confidence that their identity infrastructure, cloud environments, and critical business systems can be securely restored following an attack.
Reputiva helps small and medium-sized businesses strengthen their cybersecurity posture through cloud security assessments, identity and access management reviews, security architecture advisory, and cybersecurity readiness planning.
Whether your organization operates on Microsoft Azure, AWS, Google Cloud, or a hybrid environment, we can help identify security gaps, prioritize critical controls, and develop a practical roadmap toward stronger cyber resilience.
Strengthen your identity security. Reduce ransomware exposure. Build resilience into your business.
Take the next step toward stronger cyber resilience.
