Identity-targeted ransomware is outpacing recovery readiness

At a glance

What this is: Semperis says ransomware is increasingly shaped by AI, repeated attacks, and coercion tactics, while identity systems remain the main target and recovery readiness still lags.

Why it matters: IAM, PAM, and resilience teams need to treat identity recovery, not just data recovery, as a core part of ransomware preparation because identity compromise now drives business-wide disruption.

By the numbers:

• In 84% of attacks, threat actors weaponized artificial intelligence.
• In 87% of ransomware attacks, threat actors targeted identity systems like Active Directory, Entra ID, and Okta.
• 60% of organizations’ disaster recovery or crisis response plans do not include procedures for identity system recovery.
• In nearly 70% of attacks, the ransomware victims were targeted multiple times.

Context

Ransomware has moved beyond a backup-and-restore problem. The operating assumption that data recovery alone can restore business function fails when identity systems, not just files, are the primary target and when attackers use coercion against people as part of the extortion model.

For IAM and resilience teams, the governance gap is clear: recovery plans often treat identity as a dependency rather than a system that must be restored, validated, and trusted on its own. Cyber resilience now has to include identity continuity, not only infrastructure continuity.

The report is also a reminder that identity incidents can be operational and human at the same time. When attackers aim at staff, family members, and internal processes, response planning needs both technical recovery paths and out-of-band coordination for stressed responders.

Key questions

Q: What breaks when identity visibility is missing during a ransomware attack?

A: Containment becomes guesswork. Security teams cannot tell which accounts are active, what they can reach, or which privileged paths they unlock, so they often default to broad shutdowns or partial revocation that leaves access open elsewhere. The result is longer outages, more manual work, and higher risk that attackers keep moving while teams investigate.

Q: Why do ransomware attacks on identity systems increase business impact?

A: Identity systems control authentication, authorization, and administrative reach, so compromise there can disable recovery, widen access, and undermine trust across the environment. When attackers target Active Directory, Entra ID, or similar services, they are not just stealing access. They are attacking the control plane that lets the organisation recover and operate.

Q: How can security teams tell whether ransomware recovery will actually hold?

A: Teams should test whether recovery returns identity services to a verified trusted state and whether the same access paths can be reused by an attacker. If the restore process does not include identity validation, privilege review, and re-entry prevention, recovery may succeed operationally while failing defensively.

Q: How should organisations prepare for ransomware if they want to avoid paying ransom?

A: They should build and repeatedly test a recovery model that proves critical services can be restored without attacker cooperation. That means defining minimum viable operations, validating clean backups, rehearsing restoration sequencing, and assigning decision authority before an incident. Payment becomes less likely when recovery is demonstrated, not assumed.

Technical breakdown

Why identity systems are the ransomware center of gravity

Ransomware actors increasingly target identity infrastructure because control of directory services, federation, and privileged access can deliver enterprise-wide leverage. Active Directory, Entra ID, and Okta are not just authentication layers; they are control planes for access, recovery, and trust. When those systems are compromised, the blast radius is larger than encrypted endpoints or stolen files because the attacker can preserve, escalate, or reconstitute access. This is why identity is now a primary extortion surface rather than a supporting target. Practical implication: Treat identity systems as recovery-critical assets with their own backup, validation, and restoration objectives. See the NHI Lifecycle Management Guide.

Practical implication: Build identity recovery into resilience plans as a first-class control, not an afterthought.

Why repeated ransomware attacks change the governance problem

Multiple attacks against the same victim indicate that containment did not close the attacker’s leverage or that the organisation restored into an environment that still exposed the same weakness. This creates a governance problem rather than only a technical one: if the same identity paths, credential artefacts, or restore assumptions remain in place, a second payment or second intrusion becomes more likely. Repetition also suggests that recovery success metrics are too narrow, focusing on service restoration instead of attacker re-entry prevention. Practical implication: Measure recovery by whether the environment returns to trusted state, not merely whether systems come back online. See the Identity Threat Detection and Response (ITDR) Guide.

Practical implication: Test whether restoration removes the conditions that enabled the first compromise.

How coercion tactics expand the ransomware attack surface

Threats against employees and family members extend ransomware beyond digital extortion into psychological pressure. That matters for identity governance because people under duress, or internal personnel acting on an attacker’s behalf, can become part of the access path. The report’s numbers show that coercion is not rare and that physical or psychological intimidation is increasingly integrated into the payment strategy. The control failure is not just technical exposure; it is the absence of response planning that accounts for human pressure, escalated decision-making, and secure off-channel coordination. Practical implication: Include coercion scenarios in crisis response and executive communications planning. See the Cyber Resilience Guide.

Practical implication: Add coercion and insider-pressure scenarios to incident exercises.

Threat narrative

Attacker objective: The attacker wants to force payment by controlling identity infrastructure, repeating pressure, and making resistance more costly than surrender.

1. Entry typically begins with compromise of identity infrastructure or adjacent access paths that let attackers reach directory and federation systems.
2. Credential or administrative control is then used to expand authority across Active Directory, Entra ID, Okta, or related identity services.
3. The attacker uses that access to encrypt systems, repeat intrusion attempts, and increase pressure through psychological or physical threats.
4. Impact is measured in ransom payment pressure, operational disruption, and degraded trust in identity recovery processes.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity recovery is now part of ransomware resilience, not a separate specialty. The report shows that attackers are targeting identity systems in 87% of incidents, while 60% of disaster recovery or crisis response plans still omit identity recovery procedures. That mismatch means the programme boundary is wrong: organisations are designing resilience around data restoration while attackers are winning at the identity layer. The practitioner conclusion is simple: recovery design must treat identity as a business-critical control plane.

Repeated extortion is a symptom of unresolved identity trust, not just poor incident hygiene. When nearly 70% of victims face multiple attacks, the issue is rarely a single event. It usually means the environment was restored without closing the access, authority, or recovery assumptions the attacker exploited. Identity blast radius: the practical measure is not how much data was encrypted, but how far compromised identity reach extended before and after recovery. Practitioners should redefine success as restoration into a trusted identity state.

Psychological coercion turns ransomware into a governance and duty-of-care problem. If 40% of attacks involve psychological or physical threats against staff, the response model has to account for human pressure as an operational dependency. That changes how escalation, communications, and secure decision-making are run during an incident. Identity teams and crisis leaders need a response model that protects both the trust fabric and the people who maintain it.

Identity is the payer leverage point, which is why recovery discipline matters more than ransom optics. The report’s framing is clear: attackers make resistance more expensive by attacking the systems that decide who can act. That is why identity governance, crisis response, and cyber resilience have converged. The practitioner conclusion is that identity controls now sit inside the ransom economy, not outside it.

From our research library:

• Gartner predicts that by 2026, 30% of enterprises will consider identity verification solutions unreliable in isolation because of AI-driven attacks.
• Read next: NHI Lifecycle Management Guide

What this signals

Identity continuity will become a board-level resilience metric. As ransomware operators keep targeting the systems that issue and validate access, organisations will be judged less on whether they have backups and more on whether they can re-establish trusted identity quickly after disruption. The next maturity step is to align recovery objectives with identity trust restoration, not just service uptime.

Coercion-aware response planning is becoming part of identity governance. Staff-targeted threats force incident teams to think beyond technical containment and into safe communications, role continuity, and stress-aware decision-making. Programmes that still separate human response from technical recovery will struggle to cope with this attack model.

Resilience engineering now needs a named identity recovery layer. The practical shift is to treat directory services, federation, and privileged access as recoverable business infrastructure with explicit restoration tests. Without that layer, crisis plans can pass paper reviews while failing under real ransomware pressure.

For practitioners

• Audit identity recovery readiness Verify whether Active Directory, Entra ID, Okta, and other identity services can be restored to a trusted state under crisis conditions, not just brought back online.
• Add identity-specific crisis procedures Insert identity restoration, privilege validation, and trust re-establishment steps into disaster recovery and crisis response plans.
• Exercise coercion scenarios Run tabletop exercises that include staff intimidation, family-targeted threats, and out-of-band communications when core systems are unavailable.
• Measure restoration against attacker re-entry Track whether recovery removes the access paths, credentials, and trust relationships that enabled the initial ransomware event.

Key takeaways

• Ransomware is increasingly an identity-layer problem, not only a backup-and-restore problem, because attackers target the systems that control authentication and privilege.
• The report shows both repeated attacks and coercive pressure against staff, which means technical recovery alone is not enough to stop the extortion cycle.
• Organisations need identity-specific recovery procedures, tested trust restoration, and crisis plans that account for human pressure as well as system restoration.

Related NHI Mgmt Group resources: Cyber Resilience Guide · Identity Threat Detection and Response (ITDR) Guide · NHI Lifecycle Management Guide

Key terms

• Identity Recovery: Identity recovery is the process of restoring identity systems to a trusted state after compromise. It includes containment, forensic validation, removal of persistence, and confirmation that access controls and directory relationships no longer expose the environment.
• Ransomware coercion: Ransomware coercion is the use of psychological pressure, threats, or physical intimidation to increase the likelihood of payment. It turns an extortion event into a human-risk problem as well as a technical one, which means response planning must address staff safety, communications, and decision-making under duress.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Trusted Restore State: A trusted restore state is a recovered identity environment that has been verified as clean before normal operations resume. The concept matters because a technically successful restore can still reintroduce malicious changes, stale privilege, or hidden persistence if trust validation is skipped.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.