Ransomware in 2026 Explained: AI-Powered Attacks, Threats Against Staff and How to Protect Your Business

Ransomware has changed more in the last two years than in the previous ten. It began as malware that locked files for a fee, then became double extortion, where criminals also stole data and threatened to leak it. Now a new report suggests a third phase: AI-powered attacks, direct pressure on employees and their families, and a laser focus on the identity systems that run a company's logins. This guide explains how ransomware works in 2026, what the newest data shows and what practical steps protect a business or household.

Ransomware is malicious software or an extortion campaign designed to make you pay. Attackers break into a network, often through stolen credentials, phishing or an unpatched system, move around quietly, steal data and then lock or threaten to leak it. They demand payment, usually in cryptocurrency.

The progression is a response to better defences. When backups let companies recover without paying, attackers added data theft. Now, with both in play, they look for additional leverage.

In 84% of attacks reported by victims in the survey, the attackers used AI. In the UK the figure was 88%. Researchers say AI helps criminals write malicious code faster, reduces mistakes in encryption routines, tests code with large language models and complicates attribution for law enforcement. Chris Inglis, a former US National Cyber Director, warned that autonomous ransomware attacks are already part of the mix.

About 44% of victims said attackers exploited their own AI systems. As companies adopt AI assistants and agents that connect to email, files and identity systems, those tools can become a path into the network. One of the report's authors warned that organisations adopting AI agents should assume some agents will, at some point, try to reach identity systems, even if the action is not intended to be malicious.

Nearly nine in ten attacks (87%) went after identity infrastructure, including Active Directory, Entra ID and Okta. These systems decide who can log in and what they can access, so controlling them is like holding the master keys. Yet only about half of the surveyed organisations have dedicated identity backups, automated identity recovery or identity-specific response plans.

The survey found that 40% of attacks involved psychological or physical threats against employees, including threats of abduction and bodily harm. In 53% of those cases, victims said the attackers followed through, with tactics such as doxxing and swatting. In 14% of organisations, some staff had to relocate or change jobs. This turns a technical crime into a personal safety issue.

Roughly 69% to 70% of victims faced multiple attacks in a year, and 59% paid at least one ransom, with 31% paying more than once. Paying does not guarantee data is deleted or that attackers will leave.

The past few weeks show how varied the targets are. In the United States, the ransomware gang Rhysida claimed it stole 2.6 TB of data from Maryland's Anne Arundel County and offered it for sale for about 25 bitcoin, roughly $2 million, with the county saying it will begin sending notification letters during the week of October 19. In Japan, a ransomware attack disrupted IDCF Cloud, a service used by government clients. Police in a joint operation also disrupted the KillSec ransomware network, seizing infrastructure and arresting three suspects, linking the group to about 1,000 attacks. These cases show both the damage criminals can do and that law enforcement can disrupt them.

VPNs, firewalls, remote support tools and email gateways are prime targets. Create a process to apply critical updates within days and to investigate for compromise after major disclosures, not just patch.

Keep offline or immutable backups, separate from your main network, and test restoring them. Data theft means backups alone will not stop extortion, but they stop a shutdown from becoming a business-ending event.

Divide the network so that a breach in one area does not expose everything. Restrict who can access sensitive data.

Know who decides, who talks to regulators, customers and police, and how you operate without email or login systems. Run exercises that include a ransom demand and a threat against employees.

Law enforcement agencies generally advise against paying, because it funds criminals and does not guarantee recovery or deletion of stolen data. In the survey, 59% of victims paid at least once, and nearly a third paid more than once, which shows that payment often fails to end the problem. Decisions should involve legal counsel, insurers and law enforcement, and may be restricted by sanctions rules.

How common is AI in ransomware attacks?

In the Semperis survey of past victims, 84% said AI was weaponised in the attack, though this reflects reported experience in a vendor survey.

Why are attackers targeting identity systems?

Controlling identity systems such as Active Directory or Okta gives access to almost everything else on the network.

Do ransomware gangs really threaten employees?

The survey found threats in 40% of attacks, including threats of physical harm, and victims said attackers followed through in more than half of those cases.

Will backups stop ransomware?

Backups help you recover from encryption, but attackers also steal data, so you need layered defences.

Should I pay the ransom?

Authorities generally advise against it. Consult legal and law enforcement experts.

What is the first step to improve ransomware resilience?

Secure identity: enable phishing-resistant multi-factor authentication, restrict admin access and back up identity systems.

Ransomware in 2026 is faster, more automated and more personal than ever. The good news is that the basics still matter: strong identity security, quick patching, tested backups and a rehearsed response plan. Organisations that prepare for both technical and human pressure will be far better placed to resist, recover and protect the people behind the systems.