Hackers used AI in most ransomware attacks and threatened staff, Semperis report found

Semperis, a cyber resilience company based in Hoboken, New Jersey, published its annual global ransomware report on Wednesday. The report found that hackers used artificial intelligence in most attacks and made psychological or physical threats against staff in 40% of them.

The release posted on Semperis's website puts the share of attacks involving AI at 84%. The version distributed through PR Newswire gives the figure as 87%.

The study included only organizations that ransomware gangs victimized in the past 12 months, Semperis said. It covered the U.S., U.K., France, Germany, Italy, Spain, Singapore, Canada and Australia. The survey reached 1,200 IT and security professionals spanning eight industry sectors, according to CBS News.

In 53% of cases, victims reported that hackers followed through on their threats, Semperis said. Some 25% of victims sought psychological and medical treatment, and 24% of victims or their families hired personal security.

Semperis also said 14% of organizations reported that sustained threats drove employees or their family members to relocate their homes, switch jobs or move to different office locations.

"Holding you at physical risk is the latest phenomenon because we've covered most of the other risks," said Chris Inglis, the first U.S. National Cyber Director and a Semperis strategic advisor, in a statement.

Attackers also turned victims' own AI tools against them. In 44% of surveyed cases, the criminals behind an attack weaponized the target organization's own AI agents or systems, according to Semperis.

"AI is an inflection point in their capacities to hold the same things at risk," Inglis told CBS News. He also said that autonomous ransomware attacks are already part of the mix.

Identity systems remained a main target. Semperis said 87% of attacks went after systems such as Active Directory, Entra ID and Okta, yet half of companies maintain dedicated identity backup systems. Semperis also said 31% of victims made multiple payments to attackers.

"The bad guys are always evolving their tactics," said Mickey Bresman, Semperis CEO, in a statement. He said attackers first focused on data encryption, then added data theft and threats to expose or sell the data, and will keep looking for more ways to make victims pay.