Ask Onix
Cyber extortion takes a violent turn
Tim Beasley, a U.S. cybersecurity negotiator, discovered an unsettling delivery on his doorstep a few years ago: a small package containing a note that threatened physical harm if he refused to comply with ransom demands. The warning came from the same ransomware group he had been negotiating with on behalf of a hacked U.S. government agency. Beasley, who works for security firm Semperis, discarded the box immediately but recognized the alarming shift in tactics.
Ransomware attacks reach record highs
Cyberattacks have skyrocketed globally, with the U.S. reporting over 1 million incidents in 2025-a threefold increase since 2015, according to FBI data. Financial losses from these breaches totaled $20.8 billion last year, up from $16.6 billion in 2024. The U.K. also saw a surge in cybercrime, mirroring the trend.
Traditionally, hackers infiltrate systems to steal data or lock businesses out, demanding payment for its return. However, a growing number of attackers now resort to physical threats to pressure victims into paying.
Threats of violence double in the U.S.
FBI statistics reveal that physical threats linked to ransomware attacks more than doubled in the U.S. last year. Semperis research found that 40% of global ransomware incidents in 2025 included threats against employees who resisted payment. In the U.S., this figure rose to 46%.
Beasley noted the trend: "It's always lurked in the background, but it's becoming more tangible, creeping into reality."
Hackers exploit personal data to intimidate
Attackers often obtain victims' home addresses and other sensitive details, using them to instill fear. Zac Warren, chief security advisor at Tanium, described a case where hospital employees received harassing calls. Hackers addressed nurses by name, recited their home addresses and Social Security numbers, and implied they were under surveillance.
"They made people feel watched. The intimidation was intense," Warren said.
Zac Warren, Tanium
Industrial sabotage and state-backed threats
Some attackers demonstrate control over manufacturing equipment, such as robots or conveyor belts, to show they can cause physical harm. While many ransomware groups are state-sponsored-linked to Russia, China, Iran, or North Korea-most physical threats originate from financially motivated hackers, often young individuals aged 17 to 25.
Beasley explained that these criminals frequently outsource violence: "They don't want to get their hands dirty. They recruit others online, offering cash to carry out threats or attacks."
Cryptocurrency crime fuels violent extortion
The murky world of cryptocurrency has seen some of the most severe incidents. Last May, French police rescued the kidnapped father of a crypto millionaire, who had been held for ransom in a Paris suburb. Reports indicated the victim suffered severe injuries, including a severed finger.
Europol documented over 18 such cases in Europe and the U.K. last year, noting a "dramatic increase" in cybercrime-linked physical attacks. The agency investigates "violence as a service," where criminals execute attacks for a fee.
FBI warns of rising 'violence-as-a-service' networks
The FBI issued an alert last summer about "In Real Life Com," an online network of criminals offering violence-for-hire. Adam Meyers, senior VP at CrowdStrike, described the group's escalating aggression:
"If you want someone harmed, you can find someone in 'The Com' willing to do it-bricks through windows, arson, shootings, or kidnappings. Less tech-savvy criminals often rely on violence because it's all they can contribute."
Adam Meyers, CrowdStrike
Meyers added that cryptocurrency investors often attract attention by flaunting wealth online, making them prime targets. "They discuss trades and profits publicly, drawing unwanted scrutiny."
Why the trend won't slow down
Beasley warned that physical threats will likely continue rising as long as victims keep paying ransoms. "People fear for their families. It makes you look over your shoulder."
