Ransomware Gangs Shift Tactics to Real-World Threats Amid Payment Declines

• •Ransom payments have decreased from 78% in 2024 to 59% in 2026.
• •Ransomware gangs are using real-world threats to pressure victims into compliance.
• •Healthcare sector ransomware attacks have doubled, averaging 3.33 incidents daily.

Ransomware gangs are increasingly using real-world threats against business executives and their families to pressure organizations into paying ransoms, as a recent Semperis report indicates a decline in ransom payments from 78% in 2024 to 59% in 2026. The report highlights a shift from data-centric crimes to people-centric extortion, with threats of violence becoming more common. Experts note that while actual assaults remain rare, intimidation tactics such as doxxing are on the rise, particularly in Europe and the Middle East. In parallel, ransomware incidents in the healthcare sector have doubled, with an average of 3.33 attacks per day reported in Q3 2026. The healthcare industry, seen as a lucrative target, faces escalating risks due to inadequate cybersecurity measures. Microsoft also reported a 39% increase in ransomware attacks in Costa Rica, emphasizing the global rise in such incidents. Organizations are advised to bolster their defenses and prepare for potential attacks.