Shift toward personal harassment
Recent data indicates a change in how ransomware groups operate. While these criminals previously focused on encrypting files to demand payment for their release, many now use psychological pressure to ensure a ransom is paid. According to a global survey, 37% of attacks now include threats directed at specific people within a company, including owners and senior managers.
These tactics often involve 'doxing', which is the gathering and public release of private information such as home addresses, personal phone numbers, or photographs. In some cases, criminals have contacted the families of employees to increase the pressure on the business to comply with demands.
Bypassing technical defences
This trend suggests that as technical security measures improve, criminals are targeting the human element of a business instead. Even if a company has reliable backups and can restore its systems without paying a ransom, the threat of personal harassment or the leaking of sensitive staff data remains a significant problem.
By targeting individuals, attackers aim to create internal conflict within a business. They hope that distressed employees or their families will pressure the company leadership to pay the ransom, regardless of whether the technical systems have already been recovered.
Recommendations for UK businesses
It is not known exactly which groups are most likely to use these tactics, but the practice is becoming more common across the cyber-crime industry. Business owners should consider the following steps:
- Staff briefings: Inform employees that personal threats are a documented tactic. Knowing that this is a standard criminal procedure can help reduce the initial shock if it occurs.
- Privacy settings: Encourage staff to review the privacy settings on their social media accounts and to be cautious about how much personal information is available in the public domain.
- Support plans: Ensure your business has a plan for how to support an employee who is being harassed. This should include legal advice and, where necessary, involving the police.
Traditional security measures like firewalls and backups remain necessary, but they do not address the personal risks now associated with these attacks.