What percentage of people targeted in the analyzed ransomware campaign were managers?

Almost two-thirds, roughly 67%, held managerial positions or higher, according to the ZDNET analysis.

Why are managers specifically targeted by ransomware attackers?

Managers often have broad access to operational data, financial approvals, and administrative systems, and they receive a high volume of emails from both subordinates and leadership, making phishing highly plausible.

How has ransomware targeting strategy changed compared to earlier campaigns?

Attackers have shifted from pursuing the biggest payout by targeting C-suite executives to focusing on mid-level managers, especially in IT, operations, or finance, who possess practical access to critical systems with less security scrutiny.

What privacy risks do these attacks create for employees who aren't directly targeted?

Compromised manager accounts can expose sensitive employee data like performance reviews, salary information, and health details, causing a data privacy incident that affects many employees who never clicked a malicious link themselves.

Which specific managerial roles are most at risk in this campaign?

Mid-level managers in IT, operations, or finance are prime targets because they hold practical keys to critical systems without the same level of dedicated security resources given to C-suite executives.

Ransomware Campaign Targets Managers in Two-Thirds of Cases

Managers Are Now Ransomware's Preferred Entry Point

A new analysis of a single ransomware campaign has found that almost two-thirds of the people targeted held managerial positions or higher. That statistic, reported by ZDNET, marks a notable shift in how ransomware operators choose their victims. Rather than casting a wide net across an entire workforce, attackers appear to be deliberately singling out people with elevated access, decision-making authority, or both.

This isn't just a curiosity for security teams. It has real implications for the privacy of employees, the sensitivity of data these managers control, and the way organizations think about who actually needs to be trained and protected most urgently.

Why Managers Have Become Prime Targets

The logic behind this shift is straightforward once you consider what a manager typically has access to. Managers often sit at the intersection of operational data, HR records, financial approvals, and administrative permissions across multiple systems. Compromising one account can give an attacker a much broader foothold than compromising a frontline employee's account would.

This mirrors a pattern security researchers have already flagged elsewhere. As covered in a related report on how ransomware gangs now target IT managers instead of CEOs, attackers have moved away from the assumption that the biggest payout comes from going after the very top of the org chart. Instead, mid-level managers, especially those in IT, operations, or finance, often have the practical keys to critical systems without the same level of scrutiny or security resources typically reserved for C-suite executives.

Managers are also attractive because they sit in a communication sweet spot. They receive a high volume of emails from both subordinates and senior leadership, making phishing attempts that impersonate either direction plausible. A message that looks like it's from a direct report requesting sign-off, or from an executive requesting an urgent action, is exactly the kind of social engineering that exploits a manager's daily routine.

The Privacy Implications Nobody Is Talking About

What often gets lost in ransomware coverage is the personal privacy exposure tied to these attacks. Managers frequently have access to sensitive employee information: performance reviews, salary data, disciplinary records, and sometimes health or family details shared during one-on-one conversations. When a manager's account or device is compromised, that personal data belonging to their team members becomes exposed too, not just company intellectual property or financial records.

This creates a ripple effect. An attack that starts as a ransomware incident targeting one manager can quietly become a data privacy incident affecting dozens of employees who never clicked a malicious link themselves. Organizations weighing their ransomware defenses need to account for this secondary layer of exposure, particularly under data protection regulations that hold companies accountable for safeguarding employee information regardless of how a breach occurred.

Six Practical Steps to Reduce the Risk

Based on the patterns behind this campaign, a few concrete measures stand out as genuinely useful, rather than generic advice:

Apply the principle of least privilege to management accounts. Managers should only have access to the systems and data they actually need for their role, not blanket access inherited from a title.
Use separate credentials for administrative tasks. If a manager needs elevated access occasionally, that access should require a distinct login, not their everyday email account.
Prioritize phishing simulation training for management tiers specifically. General staff-wide training is useful, but managers face more targeted and convincing lures, and their training should reflect that.
Enforce multi-factor authentication everywhere, with no exceptions for convenience. Attackers targeting managers are counting on faster approvals and less friction; MFA closes that gap.
Segment networks so a single compromised account can't reach everything. Limiting lateral movement reduces how much damage one stolen credential can do.
Maintain tested, offline backups of critical data. Even if an attack succeeds, a solid recovery plan reduces the leverage ransomware operators have during negotiations.

What This Means For You

If you're a manager, this report is a direct signal that your inbox and your accounts carry more risk than you may have assumed. It's worth asking your IT or security team whether your access privileges match what you actually use day to day, and whether you're receiving training tailored to the kinds of targeted phishing attempts managers specifically face.

If you oversee security policy, this is a reason to revisit who gets trained most intensively and how account privileges are distributed across your organization's management layer. The data suggests that ransomware targets managers not randomly, but because of what their role grants them access to.

The Bottom Line

The fact that ransomware now targets managers so disproportionately should reshape how organizations prioritize security training and access controls. It's not about assuming every manager is a weak link, it's about recognizing that their position in the org chart makes them a high-value target regardless of intent or awareness. Reviewing access privileges, tightening authentication requirements, and delivering role-specific training are practical steps any organization can take starting now, without waiting for an incident to force the issue.