Ransomware gangs threaten Australian executives & families

Semperis has published research showing that ransomware attacks on Australian organisations increasingly include threats to the physical safety of executives and their families. The findings indicate that 41% of attacks involved psychological intimidation or physical threats.

The study surveyed cybersecurity executives at organisations hit by ransomware in the past 12 months. Among Australian organisations that reported threats, attackers followed through in 53% of cases.

The most common forms of intimidation were hostile packages or letters sent to home or office addresses, reported in 70% of attacks involving threats. Physical intrusions at a home or office featured in 47% of cases, while 41% involved intimidation of family and friends.

The effects extended beyond the immediate cyber incident. Among victims, 51% said they or their families hired personal security after an attack, 47% sought psychological or medical treatment, and 35% said they or family members were swatted.

Another 26% said they were forced to move to a different job, office, or home address. The figures point to a widening impact from ransomware incidents, with personal and family security becoming part of the fallout for some executives and security staff.

Separate findings in the report suggest repeated attacks remain common. The research found that 84% of Australian organisations were attacked more than once, while 79% paid a ransom and 57% paid multiple times.

AI and identity

The report also found that artificial intelligence featured in every attack covered by the study. It added that 98% of successful ransomware attacks targeted or exploited identity systems such as Active Directory, Entra ID, and Okta.

Despite that, the research found lower levels of preparation for identity recovery. Among companies surveyed, 63% maintained dedicated identity backup systems, while 59% had automated identity recovery in place.

Gerry Sillars, Vice President, Asia Pacific and Japan at Semperis, said the results showed that cyber resilience planning needed to cover more than systems recovery.

"The ASD's recent guidance is a reminder that identity has to be at the centre of cyber resilience: if attackers take control of Active Directory, they can gain control of an organisation's enterprise IT network. Our Australian findings show the human impact can be just as serious as the technical one: in 53% of cases involving Australian organisations, victims said attackers followed through on their threats. Preparation must go beyond restoring systems, combining trusted identity recovery with a response plan that accounts for people's safety and wellbeing," Sillars said.

The findings come as Australian organisations continue to face pressure from a shortage of cybersecurity workers, a factor that may complicate retention when staff face personal risks as well as operational stress.

Tim Beasley, Senior Incident Response Consultant at Semperis, described the toll these incidents can take on cybersecurity teams and senior security leaders.

"IT and cybersecurity staff are already dealing with high levels of stress. A ransomware attack takes that to a whole new level. I have seen CISOs say, 'I'm out. I'm done. I can't do this. It isn't worth it.' I've seen people walk out the door because leadership thought they mismanaged something that caused the breach to occur. It all takes a mental toll," Beasley said.

The wider report argues that ransomware tactics have evolved from data encryption to pressure tactics aimed at forcing payment. Mickey Bresman, Chief Executive Officer at Semperis, said attackers were adapting as organisations improved backup and recovery processes.

"The bad guys are always evolving their tactics. When the initial wave of ransomware attacks began, most focused on data encryption. Then, after data backup and recovery systems started gaining traction and enabling companies to resist ransom demands, we saw double extortion: encryption coupled with data theft and threats to expose or sell that data. So it makes sense that we'll continue to see attackers trying to find more ways to make victims pay," Bresman said.