Identity systems were targeted in 87% of ransomware incidents, yet fewer than half of affected organizations had automated recovery tools. Semperis’ 2026 Ransomware Risk Report exposes a troubling disconnect between where attackers are concentrating their efforts and where organizations are prepared to recover.
AI adds another concern, with 84% of surveyed victims reporting attacks involving the technology.
Based on a survey of 1,200 IT and security professionals across 9 countries, the report examines how attackers are exploiting enterprise AI agents, returning to previously compromised organizations, and threatening employees and their families.
The findings reveal persistent weaknesses in identity recovery and crisis planning that can leave organizations vulnerable long after an initial attack.
Why It Matters: The gap between identity attacks and recovery readiness exposes a major weakness in cyber resilience. With attackers exploiting enterprise AI agents and repeatedly compromising organizations, the ability to restore identity systems securely is becoming essential to limiting disruption and regaining control.
- Enterprise AI Is Creating New Opportunities for Attackers: AI was involved in 84% of reported ransomware attacks, including 44% in which attackers exploited organizations’ own AI agents or systems. Defensive AI also fell short in some cases, with 23% of respondents reporting that their AI security tools failed to detect or stop an attack.
- Repeat Attacks Are Exposing Gaps in Recovery: Nearly 7 in 10 organizations experienced multiple successful ransomware attacks, while 59% paid a ransom. Among those that paid, more than half made multiple payments. Nearly a quarter of ransom payers said they paid because they could not remove attackers from their environments.
- Identity Recovery Capabilities Are Lagging Behind Attacks: Only half of surveyed organizations maintained dedicated identity backups, while 42% had automated recovery solutions. In the United States, 94% reported attacks targeting identity infrastructure, yet just 20% had automated recovery tools.
- Ransomware Threats Are Extending Into Employees’ Personal Lives: More than a third of respondents reported threats against employees’ families or friends, including incidents involving doxxing, swatting, and physical intimidation. More than half reported that attackers followed through on threats. Some incidents resulted in medical treatment or additional personal security measures.
- Crisis Response Weaknesses Are Complicating Recovery: Nearly half of respondents cited unclear responsibilities during cyber incidents. Communication gaps and outdated response plans were each reported by 44%. Semperis recommends strengthening identity recovery procedures, establishing alternative communication channels, and testing response plans through realistic exercises.
