When cyberattacks turn physical: Threats of violence in digital extortion

How ransomware attacks are escalating from digital extortion to real-world intimidation

Key takeaways

• Cyberattacks are increasingly paired with threats of physical harm, targeting employees, executives and sometimes their families.
• Ransomware groups are escalating pressure tactics as payment rates decline, pushing them toward more aggressive extortion methods.
• Attackers are expanding their focus beyond organizations to individuals and communities, including students, parents and healthcare workers.
• Critical sectors like healthcare and education are targeted because disruption can create immediate real-world risk and urgency.
• The line between cyber and physical threats is blurring, requiring organizations to integrate cybersecurity, physical security and crisis response.
• Security teams need to shift their focus from prevention alone to resilience, rapid response and protection of people instead of just systems.

A growing convergence of digital and physical threats

Cyberattacks have always had real‑world consequences. A ransomware incident can halt production, delay patient care or shut down public services. But until recently, most attacks relied strictly on digital leverage: encrypt data, threaten to leak it and demand payment.

Threat intelligence and industry reporting now point to a clear shift toward hybrid attacks that combine cyber intrusion, psychological pressure and real-world intimidation.

In practical terms, attackers are no longer satisfied with controlling systems. They are increasingly trying to control outcomes and influence decisions and behavior by introducing fear that extends beyond the network.

A shift from digital extortion to personal intimidation

Ransomware has evolved through several phases: encryption-only attacks, double extortion, and now more aggressive forms of coercion.

Recent research shows that many ransomware incidents now include explicit threats of physical harm, often directed at employees or executives if payment is not made.

Threat actors are also gathering personal data about staff, including home addresses and family details, to increase pressure. In some reported situations, attackers have attempted to move beyond digital communication and create a perception of direct, physical risk.

This represents a fundamental change. Your attack surface now includes your employees’ personal lives, not just your IT environment.

What’s driving this escalation?

• Declining success with traditional ransomware tactics: Ransomware attacks are increasing in volume, but fewer organizations are paying. Attackers are responding to this trend by escalating the use of intimidation and threats.
• A more competitive, fragmented threat landscape: The ransomware ecosystem is expanding, with more groups competing for victims and revenue. That competition rewards aggressiveness. New or smaller groups, in particular, may adopt extreme tactics to differentiate themselves and increase their chances of getting paid.
• Targeting sectors where disruption equals pressure: Healthcare, education and critical infrastructure remain primary targets because disruption in these sectors creates immediate urgency. Healthcare is a clear example. It was the most targeted sector for cyberattacks in 2025, with attackers exploiting the risk to patient care to increase pressure on victims. In these environments, the line between operational disruption and real-world harm is already thin. Attackers are simply exploiting that reality.

The broader convergence of cyber and physical risk

Across threat reporting, one theme appears consistently: cyber, physical and geopolitical risks are converging. Organizations now face multilayered attacks that combine technical compromise with real-world consequences and psychological pressure, making traditional security boundaries less meaningful.

How cybersecurity teams should respond

Expand your threat model beyond IT

You need to account for scenarios involving harassment, doxxing and threats against employees, not just system compromise. That means closer coordination between cybersecurity, physical security, HR, and executive leadership.

Protect people as part of your security strategy

Reducing exposure of employee data and preparing for targeted threats should be part of your security program. This includes reviewing data handling practices, limiting unnecessary exposure and providing guidance to staff on personal security.

Integrate cyber incident response with crisis management

Incident response plans should now include communication strategies, law enforcement engagement and escalation paths for physical threats. Tabletop exercises that combine cyber and physical scenarios can help you identify gaps before they matter.

Focus on detection speed and response

The faster you detect and contain an attack, the less opportunity attackers have to escalate or apply pressure to vulnerable individuals. Modern detection and response capabilities, such as those provided by Barracuda Managed XDR, help reduce dwell time and limit the pressure attackers can apply.

The bottom line

Cyberattacks are no longer confined to data and systems. They are increasingly designed to create fear, urgency and real-world consequences.

For cybersecurity teams, that means expanding your definition of risk. Protecting your organization now also means protecting your people and preparing for scenarios where digital attacks spill into the physical world.

And as those lines continue to blur, resilience becomes just as important as prevention.