Ransomware gangs use stolen personal data to threaten victims with real‑world violence

Ransomware groups are increasingly employing "double extortion" tactics: after encrypting a company’s systems they also steal large volumes of personal information such as home addresses, social‑security numbers and family details. The stolen data is then used to intimidate individuals in person, with threat notes left at doors or phone calls that read out private addresses. The FBI reported that physical threats in the United States more than doubled last year, and researchers estimate that roughly 40 % of global ransomware attacks now involve some form of intimidation, with higher rates in the U.S.

A nascent illicit services market has emerged, where young criminals outsource violent actions to local enforcers for a fee, reducing their own risk. The model extends to extreme acts such as arson, burglary and even kidnapping. Notably, families of cryptocurrency investors who publicly flaunt their wealth have become targets; French police rescued the father of a crypto‑millionaire who had been abducted for ransom. These developments blur the line between cybercrime and physical crime, prompting calls for new security approaches.

Experts, including Prof. Dr. Dennis‑Kenji Kipker, warn that the convergence of digital extortion and real‑world threats poses a growing danger to both employees of compromised firms and the broader public.