AT A GLANCE
Ransomware pressure is reaching beyond data and systems. Investigators have seen executives receive photographs of their children’s schools, while Semperis respondents reported physical threats and harm to staff or families. Backups remain essential, but the incident plan must also protect people. Brief families, prepare for intimidation and keep awareness training practical and regular..... a completion certificate will not prepare somebody for a threat at home.
Ransomware investigators have seen criminals send executives photographs of their children’s schools to pressure them into paying........deliberate cruelty..... using a parent’s fear as another means of extracting money.
Semperis surveyed 1,200 IT and security professionals whose organisations had suffered ransomware attacks. Respondents reported physical threats in 17% of cases, while 25% reported staff or families needing medical or psychological treatment.
Separately, the FBI has documented cybercriminal networks using kidnapping, torture and threats against relatives in cryptocurrency extortion.
The boundary between cybercrime and physical violence has already been crossed.
As organisations strengthen backups and recovery, criminals seek additional pressure points.
And so, the human remains the weakest link..... and fear for your family can overwhelm even the most security-conscious professional.
Training MUST be regular, practical and continuously updated. Staff need to recognise intimidation and impersonation, independently verify unexpected requests and report threats immediately. Families also need guidance on what public posts reveal about homes, schools and routines.
Technical controls remain essential. Incident plans must also protect people, with clear routes to management, physical security and the police. Immediate threats to life require emergency assistance.
Attacks will continue evolving, combining digital intrusion, psychological pressure and physical intimidation. Awareness and preparation MUST keep pace.
From the briefing.....
In the Monday briefing, I asked readers to take this story to customers and to their own families. The practical conversation is about recognising intimidation, verifying unexpected requests and reporting threats promptly. Training needs regular updates as the methods change. The incident response must bring management, physical security and the police into the process where necessary.
THE SOURCE / FURTHER READING
Want the full feature?
You’ve read the TOP STORIES interpretation. Continue to the publisher for the source feature or detailed guidance.
Read the original feature at The Register (opens a new tab)