FBI Reports Physical Violence Threats Double in US Cyber-Attacks to $20.8 Billion Loss

Cyber-attacks globally are increasingly accompanied by threats of physical violence against victims, a worrying evolution in digital extortion. The US Federal Bureau of Investigation (FBI) reported that the number of cyber-attack instances in the US surged to a record 1,008,597 last year, up from 288,012 in 2015. Financial losses from these attacks totalled $20.8 billion in 2025, an increase from $16.6 billion in 2024. The UK also registered a record high in cyber-attacks last year.

Crucially, the FBI's annual data indicates a twofold increase in physical threats last year. Research by the US security firm Semperis found that 40% of global ransomware attacks in 2025 included threats of physical harm to staff who refused ransom demands, a figure that rose to 46% in the US.

Tactics of Intimidation

Tim Beasley, of Semperis, recounted receiving a physical threat at his US home during ransom negotiations for a US government organisation. He described the incident as a warning from the ransomware group.

Zac Warren, from US security firm Tanium, detailed an incident where hackers accessed personal data, including home addresses, of hospital employees. He stated that employees received phone calls where attackers identified nurses by name, recited their home addresses and social security numbers, creating a strong sense of intimidation.

Beyond direct threats, some attackers manipulate industrial control systems, demonstrating their ability to operate machinery like robots and conveyor belts remotely. Such actions carry the potential for serious injury or death in manufacturing environments.

While some ransomware groups are state-sponsored, originating from nations such as Russia, China, Iran, and North Korea, most physical threats stem from financially motivated young groups, often aged 17 to 25. These groups frequently outsource violent acts, recruiting individuals via message boards or social media.

The cryptocurrency sector has seen some of the most severe incidents. In May, French police rescued a kidnapped cryptocurrency millionaire's father who had a finger severed. Reports indicate over 18 such cases in Europe, including the UK, last year, pointing to a 'dramatic increase' in cybercrime involving physical assaults. Europol is investigating these incidents as part of its efforts against 'violence as a service'.

The FBI issued an alert last summer regarding 'In Real Life Com', a network of online criminals offering 'violence-as-a-service', ranging from vandalism to kidnapping. Adam Meyers, from Crowdstrike, noted that less technically sophisticated individuals often turn to physical violence as their primary leverage. He added that cryptocurrency investors often inadvertently draw attention to themselves by publicly discussing their wealth online, making them targets.

Beasley concluded that these threats would likely persist as long as victims continue to pay, stating, "They don't want their kids getting kidnapped."