AI used in 84% of ransomware attacks, survey of 1,200 victims finds
Representative image: iAmMrRob / Pixabay
Semperis's October 14, 2026 survey of 1,200 ransomware victims says AI was involved in 84% of attacks and staff were threatened in 40%.
What Happened
Ransomware gangs are now using artificial intelligence in most of their attacks and are increasingly threatening employees in person, according to a survey of ransomware victims published on Wednesday, October 14, 2026, by the identity security company Semperis. Its 2026 Ransomware Risk Report surveyed 1,200 IT and security professionals in nine countries and eight industries, all from organisations hit by ransomware in the previous 12 months. Respondents said AI was involved in 84 per cent of the attacks they suffered, and 44 per cent said attackers had turned the organisation's own AI systems against it.
Key Facts
- Semperis published its 2026 Ransomware Risk Report on October 14, 2026, based on a survey of 1,200 IT and security professionals in nine countries.
- Only organisations hit by ransomware in the previous 12 months took part.
- Respondents said AI was involved in 84 per cent of the attacks they experienced; one version of the company's release gives the figure as 87 per cent.
- 44 per cent said attackers exploited the organisation's own AI agents or systems during the intrusion.
- 40 per cent of attacks included psychological or physical threats against employees or their families.
- Identity systems such as Active Directory, Entra ID and Okta were targeted or exploited in 87 per cent of cases, and 69 per cent of victims suffered more than one successful attack within the year.
Why It Matters
Ransomware is a form of extortion in which criminals break into a company's network, lock or steal its data, and demand payment. The survey suggests the tools and tactics are changing quickly. AI can help attackers write convincing phishing messages, find weak points faster and automate parts of an attack. The finding that nearly half of victims saw their own AI tools exploited is a warning for companies racing to plug chatbots and AI agents into email, files and business systems: every new AI system with broad access is also a new door for intruders.
The report's other striking finding is that attacks are becoming personal. In 40 per cent of cases, respondents said attackers made psychological or physical threats against staff or their families, a step beyond the usual threats to leak data. Such threats are designed to frighten staff and add pressure on employers to pay.
Two cautions apply. First, these are self-reported answers from victims, gathered by a company that sells security products, not a count of all ransomware attacks worldwide. The 84 per cent figure is the share of surveyed victims who believed AI was involved, and respondents may not always know how an attack was carried out. Second, the published figures are not fully consistent across versions of the release, including the AI share itself. Even so, the direction is clear and matches what other security researchers have been reporting: AI is lowering the cost and raising the speed of cybercrime.
| Finding | Share of surveyed victims |
|---|---|
| AI involved in attacks | 84 per cent |
| Own AI systems exploited | 44 per cent |
| Threats against staff or families | 40 per cent |
| Identity systems targeted | 87 per cent |
| Hit by more than one attack in a year | 69 per cent |
Impact
Short-term: Security teams are likely to review the permissions given to AI assistants and agents, tighten protection of identity systems, and add guidance for staff on what to do if they are personally threatened.
Long-term: If AI keeps making attacks cheaper and faster, organisations will need AI-driven defences of their own, stronger backup and recovery plans, and closer cooperation with law enforcement. Regulators may also look harder at how companies secure AI systems that can reach sensitive data.
Who is affected: Companies and public bodies that run on shared identity systems, IT and security staff, employees whose personal details may be used in threats, AI tool vendors, and customers whose data is held by attacked organisations.
Key Takeaway
A survey of 1,200 ransomware victims finds AI involved in 84 per cent of attacks and threats against staff in 40 per cent, a sign that cyber extortion is becoming both more automated and more personal.
Questions and Answers
How many ransomware attacks use AI?
In Semperis's 2026 Ransomware Risk Report, published October 14, 2026, surveyed victims said AI was involved in 84 per cent of the ransomware attacks they experienced. This is a survey of 1,200 victims, not a count of every attack.
Can attackers use a company's own AI tools against it?
Yes. In the same survey, 44 per cent of victims said attackers exploited their organisation's own AI agents or systems during an intrusion, which is why AI tools with wide access to data need strict controls.
Do ransomware gangs threaten employees personally?
According to the report, 40 per cent of attacks included psychological or physical threats against employees or their families, going beyond the usual threat to leak stolen data.
How can organisations protect themselves from AI-powered ransomware?
Common steps include limiting what AI tools and accounts can access, protecting identity systems such as Active Directory with strong authentication and monitoring, keeping offline backups, training staff to spot phishing, and having a plan for recovering systems without paying a ransom.
Disclaimer: Prepared by the Peepals newsroom from publicly available sources with AI assistance. Information is accurate to the best of our knowledge at the time of publication and may change. Images may be representative. Not professional advice. Report an error via our contact page.
Sourced and fact-checked by the Peepals Global Editorial Team
Netflix lays off 1,000 staff, 6%, mostly in product and tech roles
Explosion at Intel's Kiryat Gat chip plant in Israel kills two workers
Reported, fact-checked and published by the Peepals Global Editorial Team.
