Attackers weaponized AI in 84% of ransomware attacks on surveyed victims
Partly confirmed
The takeaway
On Oct 14, 2026 identity-security firm Semperis published its 2026 Ransomware Risk Report, a survey of organizations hit by ransomware in the previous 12 months.
Status
- Claim
Partly confirmed
- Our reporting
- Medium confidence
- Importance
- 2 of 5
- Last verified
- 15 October 2026
Your AI and this story
- GPT-6 Astra167 days after its cutoff
- Claude Opus 5.5106 days after its cutoff
- Gemini 4 Argon197 days after its cutoff
- Grok 4.7136 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 106 days before it.
Key facts
- Published Oct 14, 2026 (Semperis press release, Hoboken NJ); respondents are organizations attacked by ransomware gangs in the prior 12 months; countries named include the US, UK, France, Germany, Italy, Spain, Singapore, Canada and Australia
- AI: ‘threat actors weaponized AI’ in 84% of attacks (press release); the release does not define what counts as AI use
- Identity: 87% of ransomware attacks targeted identity systems (AD, Entra ID, Okta); only half of companies keep dedicated identity backups, and 60% of recovery plans lack identity-system recovery procedures
- Threats: 40% of attacks involved psychological or physical threats against staff; 24% of victims or family members were swatted; 25% sought psychological or medical treatment
- Repeat attacks: nearly 70% of victims were targeted more than once; 31% made multiple payments
- Coverage: CBS News segment by homeland security correspondent Nicole Sganga, ‘AI now linked to 84% of ransomware attacks, report finds’ (YouTube, Oct 14; ~55k views by Oct 15)
What happened
Semperis, which sells Active Directory and identity recovery tools, released its 2026 Ransomware Risk Report on October 14, 2026 (press release1). Its headline figure is that attackers weaponized AI in 84% of the ransomware attacks reported by surveyed victims. The report also says 87% of attacks went after identity systems and 40% involved threats against staff, up to swatting of employees’ families. CBS News ran the AI figure as a news segment the same day.
The press release gives no sample size or definition of “AI use”, and secondary write-ups phrase the 84% differently (share of attacks vs. share of victims). Treat the number as self-reported survey data from a security vendor.
Why it matters
It is one of the first large surveys to put a number on how common AI-assisted ransomware has become in 2026, and it reached mainstream TV news. It sits alongside documented cases such as the South Korean bank hacks done with Chinese AI models.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 1 primary, 1 reaction
Primary
- Semperis press release: 2026 Ransomware Report reveals increases in AI-driven attacks and a rise in physical threats against executives and their familiessemperis.com, official
Reactions
Changes
- Filed from data/leads.md; facts from the Semperis press release