The pressure extends beyond locked systems
Semperis released its annual ransomware findings October 14, reporting that 40% of attacks in its surveyed victim population involved psychological or physical threats against staff. It also reported repeated targeting in nearly 70% of cases. The company says the study included only organizations victimized by ransomware gangs in the preceding 12 months. These are vendor-reported survey findings, not a measurement of the probability that any business will suffer such threats. They nevertheless raise a specific preparedness question: who helps employees when an extortion attempt becomes personal?
Keep the evidence and its limits together
A survey can expose experiences that a malware dashboard will miss, but it does not independently establish every respondent’s account. Boards should resist turning the percentages into a forecast for their own company. The useful question is whether an existing response plan accommodates the scenario at all. An exercise can test that question without assuming the organization faces the same likelihood or severity of intimidation as the survey participants.
Add people to the recovery exercise
Our analysis is that a healthcare provider should include staff support and physical-security escalation in its ransomware tabletop, alongside restoration of systems needed for care. A hypothetical threatening message to an employee should have a documented recipient, a preservation process and a clear route to qualified emergency assistance when appropriate. The exercise should avoid circulating personal information more widely than necessary. It should also establish who takes over an employee’s operational responsibilities if that person needs to step away.
Small firms need named backups
A small business may have one owner making technical, financial and communications decisions during a crisis. That concentration deserves attention before an incident. We recommend identifying an alternate decision-maker and agreeing with the MSP on how to communicate if normal accounts become unavailable. A support contract should clarify the provider’s role rather than imply it includes personal security or emergency response. Recovery planning is strongest when it assigns those different responsibilities explicitly. The objective is a plan employees can use under pressure, with decisions documented and assistance available, while technical responders continue their work.
Related: Record Ransomware Claims Demand Careful Reading—and a Recovery Test →
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
