AI linked to 84% of ransomware attacks, new report finds

Key points

• A Semperis report found 84% of surveyed ransomware victims had attacks in which cybercriminals exploited AI, and 44% reported attackers exploited their own AI systems.
• The 2026 Ransomware Risk Report polled 1,200 IT and security professionals across nine countries and eight industry sectors.
• Former White House National Cyber Director Chris Inglis said autonomous ransomware attacks are already part of the mix and argued organizations must use AI for defensive purposes.

A new global cybersecurity report says AI was exploited in ransomware attacks experienced by 84% of surveyed victims, while 44% said attackers exploited their own AI systems. The 2026 Ransomware Risk Report from cybersecurity firm Semperis polled 1,200 IT and security professionals across nine countries and eight industry sectors.

The report also described ransomware's human toll. More than a third of surveyed victims faced psychological or physical threats against employees, and 14% of surveyed organizations reported that employees or family members were forced to change jobs, office locations or residences because of sustained ransomware threats.

Multiple attacks and ransom payments

Among surveyed ransomware victims, 69% experienced multiple successful attacks sometime in the previous year. Fifty-nine percent of respondents paid a ransom at least once, and 87% experienced attacks targeting their identity systems, the digital infrastructure that controls access to their networks.

I think we're already seeing autonomous attacks. Autonomous ransomware attacks are included in the mix.

— Chris Inglis

What the experts said

Chris Inglis, former White House National Cyber Director under former President Joe Biden and a Semperis board member, said AI increases attackers' capacity and scope. He said a person without technical expertise could use AI to write code and hold a company's data hostage, adding that AI has been democratized to the point where even low level models can allow that to happen.

Semperis associate vice president of security research Tomer Bar said AI could let ransomware developers produce more sophisticated malicious code, reduce development time and make investigations harder. Courtney Guss, the firm's associate vice president of crisis management, wrote that AI agents will at some point try to compromise identity systems even if the action isn't meant to be malicious.