What is the new stage of ransomware extortion described in the article?

The report describes a shift where criminals move pressure away from the network and toward people, studying social media, breached data, public records and company pages to target employees and their families directly.

What sources do criminals use to build profiles of employees and relatives?

They use social media, breached data, public records, and company pages to gather details like relatives, home addresses, schools, and daily routines.

Why does the risk extend beyond the employee listed on a company website?

Because combined information lets attackers identify the employee's family and their location during the day, making threats feel credible and affecting relatives as well.

What is the goal of these personalized threats?

As the report puts it, the goal is to make resisting the ransom feel too costly, since a threat that names a family member lands differently than a generic message about leaked spreadsheets.

What can people do to reduce their public footprint and family exposure?

They can lock down social accounts by setting profiles to private and limiting who can see friend lists and tagged photos, and avoid posting real-time locations, school names, regular schedules, or home exteriors.

Ransomware Targeting Employees and Families Turns Personal

Ransomware extortion is getting more personal. According to a recent report from Cybersecurity News, criminal groups are increasingly focusing on ransomware targeting employees and families, using publicly available information to make threats feel direct and credible. The shift turns a corporate incident into something that can touch a worker's home life.

The good news is that much of what these groups rely on is information people can reduce, lock down or remove. Here is what the report describes and what you can do about it.

How ransomware targeting employees and families emerged

The report describes this as the next stage of extortion. Early ransomware groups relied on file encryption: lock a company's data and demand payment for the key. Many groups later added data theft and threats to leak the stolen files if the victim refused to pay.

The newest step moves pressure away from the network and toward people. Criminals can now study social media, breached data, public records and company pages to identify relatives, home addresses, schools and daily routines. Those details let them write messages that feel personal and believable.

The goal, as the report puts it, is simple: make resisting the ransom feel too costly. A threat that names a family member lands very differently than a generic message about leaked spreadsheets.

How criminals build profiles of employees and relatives

None of the sources listed in the report are exotic. They are the ordinary traces most people leave behind:

Social media: Public posts, tagged photos, friend lists and check-ins can reveal relatives, schools, hobbies and routines.
Breached data: Information exposed in earlier breaches can add addresses, phone numbers and email accounts to a profile.
Public records: Records tied to a name or address can help link an employee to household members.
Company pages: Staff listings, bios and professional profiles show who works where and in what role.

Individually, each piece looks harmless. Combined, they let an attacker move from "this person works at the target company" to "this is their family, and this is where they are during the day." That combination is what makes the message feel credible, and it is why the risk extends beyond the employee who happens to be listed on a company website.

Reducing your public footprint and family exposure

You cannot erase your history, but you can make profiling harder and slower. The report's central point is that ordinary privacy hygiene helps, so start there.

Lock down social accounts. Set profiles to private where possible, and review who can see friend lists, tagged photos and family connections. Ask relatives to do the same, since a public account belonging to a spouse or child can reveal information about you.

Limit routine and location details. Avoid posting real-time locations, school names, regular schedules or home exteriors. Posting after the fact is safer than posting live.

Audit what is already public. Search your own name, phone number and address to see what appears. Check for people-search listings and old profiles you no longer use. Data-removal services and opt-out requests can help clear some of these listings, though results vary and you may need to repeat the process.

Tighten account security. Because breached data can feed these profiles, use unique passwords, a password manager and multi-factor authentication. A VPN can add a layer of privacy for your browsing traffic, but it does not remove information that is already public, so treat it as one tool among several.

Separate work and personal identity. Consider using a different email address for personal accounts than for professional ones, and be thoughtful about how much detail goes into professional profiles.

What this means for you

If you work for any organization, you are part of its attack surface, and so, indirectly, is your household. Attackers do not need to compromise your devices to pressure you; they only need to find enough public information to sound convincing.

That does not mean a message naming your family is proof that the attacker has access to your life. Details gathered from public sources can look alarming without reflecting any deeper breach. Knowing that, you can respond calmly: do not reply or pay on your own, save the message, and report it to your employer's security team and, where appropriate, law enforcement.

What employers and individuals should do now

For employers:

Treat employee and family exposure as part of incident planning, not an afterthought.
Review what staff details appear on company pages and consider whether every name, title and photo needs to be public.
Give employees a clear, judgment-free way to report threatening or personal messages quickly.
Offer guidance on privacy settings and data-removal options, especially for executives and staff with access to sensitive systems.

For individuals:

Review your social media privacy settings this week.
Search for yourself and request removal of unnecessary listings.
Talk to family members, including teenagers, about what they share publicly.
Decide in advance who you would tell if you received a threatening message.

These groups are also growing in other ways. For context on how operations are expanding and recruiting, see our coverage of how the Moondancer ransomware group recruits affiliates in LatAm.

The bottom line

Ransomware targeting employees and families shows that extortion is no longer only about corporate systems. It is about the people connected to them. You cannot control what criminals attempt, but you can control how much they find. Audit your public footprint, lock down your social accounts, and use data-removal and privacy tools to shrink the profile anyone can build about you and your family. A few hours of cleanup now can make a threatening message far less convincing later.