Key Takeaways

  • Personal threats appeared in 41% of surveyed ransomware cases, extending incidents beyond compromised systems and stolen data (source).
  • Healthcare faced more than 500 ransomware victims in 2025, with Qilin, INC Ransom, and SafePay among the leading threats.
  • Hospitals may need to integrate employee safety, law enforcement coordination, and identity protection into ransomware planning.

The pressure tactics surrounding ransomware are becoming more personal. Rather than limiting extortion to encrypted systems, stolen records, and public leak sites, criminal groups are increasingly threatening employees, executives, and their families.

Personal threats appeared in 41% of ransomware cases surveyed, according to The HIPAA Journal's account of Semperis research. Threats against employees' friends or family appeared in 37% of cases, while 25% involved doxxing and 23% involved swatting.

Those figures change how businesses need to view ransomware response. This is no longer solely an IT outage with legal, financial, and communications consequences. In some incidents, it can become a workplace safety issue, a personal security problem, and a law enforcement matter at the same time.

More troubling, 53% of people who received personal threats said attackers followed through. Reported actions included threatening messages in 57% of cases, threats involving family members in 37%, physical intrusion in 19%, and bodily harm in 13%.

Even when a threat proves hollow, the target cannot safely assume that outcome. An employee who receives a photograph of a home, a relative's address, or a warning about police activity faces a very different decision environment from someone negotiating over a decryption key. Fear itself becomes leverage.

Healthcare organizations offer especially attractive conditions for that pressure. Hospitals, laboratories, clinics, and supporting vendors operate under intense time constraints. System downtime can delay diagnoses, interrupt scheduling, divert emergency patients, and force clinicians back to slower manual procedures. Attackers understand that operational urgency.

Data from GuidePoint Security and GRIT recorded more than 500 healthcare ransomware victims in 2025, making healthcare the fourth-most-targeted industry. Qilin led ransomware activity against the sector, followed by INC Ransom and SafePay. GuidePoint Security also tracked 124 named ransomware groups during 2025, a 46% increase from 2024.

The wider market is crowded, fragmented, and productive. Searchlight Cyber reported that ransomware groups publicly claimed 7,458 victims in 2025, 30% more than in 2024, while identifying 124 active groups. Public claims do not capture every incident, but they illustrate the scale of the extortion economy and the number of operators competing for payments.

Qilin's attack on UK pathology provider Synnovis offers a stark example of healthcare disruption. The incident reportedly caused more than $40 million in losses. The financial impact matters, but laboratory interruptions can also ripple through hospitals and clinical decisions. A pathology provider may sit outside a hospital's walls while remaining central to patient care.

What should change inside the enterprise? For starters, ransomware exercises can include physical security leaders, human resources, executive protection, communications teams, and local law enforcement contacts. A conventional tabletop focused on servers and backups may miss the moment when an attacker publishes an employee's address or sends threats to a family member.

Identity protection also deserves more attention. Strong multifactor authentication, restricted administrative privileges, prompt account disabling, and monitoring for unusual access can make initial compromise and lateral movement harder. Resilient, isolated backups can improve recovery options, although restoration planning should account for clinical dependencies rather than treating every application as equal.

Organizations can also reduce attackers' personal leverage by reviewing how much employee and executive information is publicly accessible. That does not mean attempting to erase every online trace. It means identifying exposed home addresses, family details, travel patterns, and direct contact information that could support intimidation or impersonation.

While ransomware planning traditionally focuses on restoring operations and containing stolen data, organizations must also prepare to protect the people attackers target when technical pressure alone does not produce a payment.