Ransomware identity attacks: what practitioners need to change now

TL;DR: AI is being weaponized in 84% of attacks, 87% of ransomware incidents targeted identity systems, and 60% of organisations still lack identity recovery procedures, according to Semperis, while attackers increasingly use psychological and physical threats to force payment. Recovery planning that stops at data backup is no longer sufficient when identity systems are the primary target.

Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats Against Executives and Their Families”.

By the numbers:

• In 84% of attacks, threat actors weaponized artificial intelligence.
• In 87% of ransomware attacks, threat actors targeted identity systems like Active Directory, Entra ID, and Okta.
• 60% of organizations’ disaster recovery or crisis response plans do not include procedures for identity system recovery.

Key questions

Q: What breaks when identity visibility is missing during a ransomware attack?

A: Containment becomes guesswork.

Q: Why do ransomware attacks on identity systems increase business impact?

A: Identity systems control authentication, authorization, and administrative reach, so compromise there can disable recovery, widen access, and undermine trust across the environment.

Q: How can security teams tell whether ransomware recovery will actually hold?

A: Teams should test whether recovery returns identity services to a verified trusted state and whether the same access paths can be reused by an attacker.

Practitioner guidance

• Audit identity recovery readiness Verify whether Active Directory, Entra ID, Okta, and other identity services can be restored to a trusted state under crisis conditions, not just brought back online.
• Add identity-specific crisis procedures Insert identity restoration, privilege validation, and trust re-establishment steps into disaster recovery and crisis response plans.
• Exercise coercion scenarios Run tabletop exercises that include staff intimidation, family-targeted threats, and out-of-band communications when core systems are unavailable.

Bottom line: Ransomware is increasingly an identity-layer problem, not only a backup-and-restore problem, because attackers target the systems that control authentication and privilege.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →