Semperis's survey of ransomware victims says attackers used AI in 84% of attacks, and that 24% of victims or their families were swatted

Semperis, a private identity-security company based in Hoboken, New Jersey, released its 2026 Ransomware Risk Report on 14 October. Its release says: “In 84% of attacks, threat actors weaponized artificial intelligence.”

The release reports other findings from the same survey. “Overall, 40% of attacks involved psychological or physical threats against staff.” In 53% of cases, the victims reported that the hackers followed through on their threats, and 24% of victims or family members were swatted, the practice of making a hoax emergency call that sends police to someone's home. “All told, 87% of ransomware attacks targeted identity systems like Active Directory (AD), Entra ID, and Okta.”

The release says only organisations that had been hit by ransomware gangs in the past 12 months took part. It gives no sample size, no fieldwork dates and no research firm, and points to the full report for the method. Press coverage gives a respondent count, but the Switchboard could not see it in Semperis's own release, so it is left out.

Semperis sells products to protect and recover identity systems, so its findings point toward its own market. The 84% figure is how victims describe the attacks they suffered; it does not show how AI was used or how anyone checked. It adds to this month's reports of AI in attacks, from South Korea's president on the bank hacks to the malware aimed at AI analysis tools that Cisco Talos counted.

• Claimed In Semperis's survey, threat actors used AI in 84% of attacks, and 87% of attacks targeted identity systems. Semperis
• Claimed 40% of attacks involved threats against staff, and 24% of victims or family members were swatted. Semperis
• Confirmed The release gives no sample size, fieldwork dates or research firm. Semperis