Ransomware Gangs Are Now Threatening Staff and Their Families
Ransomware crews have found a new pressure point, and it isn't your servers. It's your people, and the people they go home to.
A new Semperis Ransomware Risk Report, covered this week by the ACS's Information Age, found attackers are increasingly going after IT and security staff in person to force a payout. Among Australian victims surveyed, 41% said threats were made against their family or friends and 19% faced physical threats. Around a third were "swatted" (hoax police call-outs to their home), and nearly half ended up seeking medical or psychological help. Groups like Qilin, The Gentlemen and ShinyHunters get a name-check.
Why this matters here
This changes the maths for smaller teams. In a Central West or Northern Beaches business, one or two people often are the IT function, so a personal threat lands on a named individual, not a faceless department. Ransomware already turned up in 22% of the 302 breaches reported to the OAIC in the first half of 2026, and Qilin hit a Bathurst club only days ago. Governments say don't pay. Most Australian companies end up paying anyway.
What to do about it
"Don't pay" only holds if you can actually recover without them. Four things make that real:
- Keep backups offline or immutable. They shouldn't be reachable with the same credentials that run your network.
- Write and test an incident response plan. Decide now who you call, and what you tell staff and police.
- Lock down your identity system. Entra ID and Active Directory admin accounts are what they grab first.
- Brief your team. These threats are built to panic people into paying. Agree the response before it happens.
If you're not sure your backups would survive an attack, All IT's cybersecurity and managed IT support teams can pressure-test them and your recovery plan.
Frequently Asked Questions
Why are ransomware gangs threatening employees personally?
Because encrypting files alone stopped working once businesses got better at backups. Personal pressure, doxxing and physical threats are a way to force a payout even when the data could be restored.
Should we pay the ransom?
Australian government advice is not to pay, and paying funds the next attack with no guarantee you get your data back. The better protection is being able to recover without the attacker. Note that ransom payments must be reported within 72 hours under current rules.
We are a small team in regional NSW, are we really a target?
Yes. Automated attacks don't filter by size or postcode, and smaller teams are often seen as softer. Qilin hit a Central West club only this month, so the threat is already local.
What's the single most useful thing to fix first?
Backups an attacker can't reach or delete with stolen admin credentials. If you can restore cleanly, the threat to pay loses most of its power.
Could Your Business Recover Without Paying?
We'll pressure-test your backups, lock down your admin accounts and build a recovery plan, so extortion threats hit a business that can simply restore and move on.
Related Guide
Cybersecurity for Sydney SMBs
Explore our complete guide to protecting your business from cyber threats.
Read the Full Guide →