Ransomware attacks once followed a predictable pattern: attackers encrypted files, left a ransom note, set a deadline, and waited to get paid. Security teams built their response plans around that model, focusing on containment, backups, legal counsel, and buying time. 

That playbook is changing.  As ransom payments decline, encryption alone is no longer as reliable for attackers. So, some software groups have found other ways to pressure victims. Data theft has become part of the equation, followed by threats to leak sensitive information. Then came calls to customers and business partners, turning a victim’s own relationships into leverage. 

Leverage now has a name, a face, and a street address. 

Earlier this year, the Scattered Lapsus ShinyHunters extortion group took its attacks a step further, making the pressure personal. The group reportedly harassed, threatened, and even swatted executives and their families as part of its efforts to pressure victims into paying. 

The tactic is becoming common enough to influence the cyber insurance market, too. Liberty  Mutual added personal-harm coverage for executives and their families after seeing ransomware groups increasingly use threats against individuals to pressure companies into paying. 

Look For Signals in the Message 

Threatening language is designed to get attention. The details behind it often tell responders more. 

An attacker doesn’t need to breach a network to make a threat feel personal. Names, job titles, home addresses, and other personal details are often available through LinkedIn, property records, and other public sources. Publicly available information and open-source intelligence (OSINT) reconnaissance can give attackers enough context to make a message sound informed, targeted, and more invasive than it really is. AI has made that reconnaissance faster and cheaper. What once took hours of manual searching can now be compiled into a convincing profile of an executive and their family in minutes. 

In a recent campaign documented by Microsoft Security, attackers researched employees and organizational structures, likely through social platforms, then contacted them on personal phone numbers while posing as IT support. Some of those calls led to cloud compromise and data collection. 

For investigators, that creates an important distinction: a personalized threat is not proof of a breach. A home address pulled from a public record is one thing. A personal phone number, information from an HR file, a work schedule, or benefits records is another.  Nonpublic information can indicate internal access, and that should change both the direction of the investigation and how the threat is assessed. 

The same applies to specificity. A message that names a CEO differs from one that references a family member, a travel itinerary, or another detail not readily available online.  The more specific and private the detail, the more important it is to determine how the attacker got it. 

In every case, responders need to separate what could have been assembled through OSINT from what may indicate a real compromise. 

Investigate Systems That Hold Employee Data 

When a threat contains information that may have come from inside the organization, the investigation must widen. Domain controllers, backups, and financial systems still matter. But HR databases, organizational charts, executive calendars, and benefits records may contain exactly the kind of information an attacker could use to make a threat more personal. 

This is where correlation matters. If investigators uncover suspicious access to an HR system and an extortion message later includes private information about an executive or employee, the two events carry far more weight together than on their own. The message may offer clues about what was accessed, while forensic evidence can help determine whether the attacker’s claims hold up. Automation helps here. When unusual access to HR and other personnel systems is flagged and automatically correlated, responders can quickly connect it to an extortion message instead of piecing it together across separate tickets and teams. 

Know When to Involve Physical Security 

Personal information showing up in an extortion campaign does not automatically mean someone is in physical danger. But the team should have a clear threshold when the response expands beyond the cyber team. That threshold might include nonpublic location information, threats involving family members,  evidence of surveillance, or other details suggesting the attacker has moved beyond generic online intimidation. 

At that point, the cybersecurity team’s role is to preserve evidence, determine what systems and data were accessed, and bring in the right people quickly. Corporate security or executive protection teams can assess the threat's credibility, verify the information used, and decide whether protective measures or police involvement are warranted. Smaller organizations may not have those functions in-house. In those cases, the same coordination should exist between cybersecurity, HR, legal, and law enforcement. 

The targeted employee also needs clear guidance. They should not respond to the attacker directly, should preserve every message, voicemail, and screenshot, and should route any further contact through the response team. Where swatting is a concern, it is worth working with local law enforcement in advance. 

The important part is deciding where that threshold is before an incident crosses it.  Practice the response before a real threat 

Most ransomware tabletop exercises focus on the decisions leaders already expect to make, such as restoring backups, meeting disclosure deadlines, consulting legal counsel, and communicating with the board. Those exercises should now include a scenario in which an attacker publishes personal information or directly threatens an employee. 

That immediately raises several questions, such as: Who determines whether the information is public or stolen? Who investigates the systems that may have been accessed? Who contacts the targeted employee? When does physical security or law enforcement get involved? And who owns communication between those teams? Running through those questions in advance can expose unclear ownership and slow handoffs before they matter in a real incident. 

Reduce What Attackers Can Find

Preparation also means limiting the raw material attackers can use. Security, HR, and communications teams can reduce employee information exposure by requesting removal of executives’ home addresses and phone numbers from data broker sites, limiting how much organizational detail is published online, and reviewing who can access personnel data internally. Executives and their families should also be briefed on what these threats can look like and how to verify anyone who contacts them claiming to be from IT or the company. 

Prepare for the Next Phase of Cyber Extortion 

Security teams have spent years expanding the perimeter to cover endpoints, cloud infrastructure, identity, and the supply chain. Attackers are now testing another boundary: the people behind the business. 

When an attacker demonstrates meaningful knowledge about an employee or executive, the incident can no longer be judged only by what happened to systems, data, or operations. Responders need to understand where the information came from, whether it points to deeper compromise, and when the situation must expand beyond cybersecurity. 

As extortion moves beyond systems and data, recognizing when a cyberattack is starting to turn physical is part of the response itself.