Phone calls to the homes of hospital staff now sit alongside encrypted servers and leaked databases in the extortion playbook, a far more personal turn for healthcare ransomware. A survey of victims commissioned by Semperis tied 37% of attacks to threats aimed at the friends or family of employees, while 41% of respondents reported facing physical or psychological intimidation themselves.
Hard economics sit behind that move. Semperis’ third annual ransomware report, weighed in the survey work, traced the share of victims who pay falling across three years: 69% in 2025 and 59% in 2026, down from 78% in 2024. Crews now lean on people rather than systems because encryption and leak threats have lost their edge. Threatening texts, letters, or packages reached 57% of those targeted personally. Abduction was threatened against 17%, physical intrusion against 19%, bodily harm against 13%, and stalking against 6%. The attackers carried through in 53% of cases.
Care teams absorb the consequences. Medical or mental health care was needed by roughly a quarter of those targeted, and 14% changed jobs, offices, or homes. Doxxing was reported by about 25%, and swatting – a false report that sends police to a victim’s address – by 23%.
For hospital security leaders, the lesson is to build employee-safety response into the incident plan before it is needed. That covers a script for staff facing intimidation, a decision tree for threats aimed at a clinician’s family rather than the network, and relationships with law enforcement set up in advance. As Semperis crisis lead Courtney Guss observed, those contacts are a faster route to help when they are already in place.
