AI used in both attack and defense

Artificial intelligence is being used in two ways in ransomware attacks, according to a report titled Ransomware Risk Report 2026 by the company Semperis, released on October 14. The report found that 20 percent of ransomware attacks in France involved the attackers exploiting AI tools already in use by the victims.

AI on the attackers' side is rare

The report also noted that AI was used by the attackers themselves in only 1 percent of the incidents studied. This highlights a significant imbalance in how AI is being used in the context of ransomware attacks.

French companies face repeated attacks

French businesses surveyed in the report experienced multiple ransomware attacks over the past year, with 51 percent reporting several attacks in the same week. Hackers successfully extorted payments from 35 percent of the companies, and 86 percent of those who paid made multiple payments.

Financial and operational impact

More than two-thirds of the affected companies experienced business interruptions or revenue losses, and 65 percent suffered data theft or destruction. These consequences underscore the severe impact of ransomware attacks on organizations.

Global AI involvement in attacks

Globally, AI played a role in 84 percent of the ransomware attacks studied. In nine countries covered by the survey, 40 percent of attacks involved AI used by hackers, while 44 percent exploited AI tools or systems already in use by the victims.

Identity systems are prime targets

The report found that 87 percent of the attacks studied targeted or exploited identity management systems such as Active Directory, Microsoft Entra ID, or Okta. These systems control user access and account management within organizations. However, only half of the surveyed companies had dedicated backups for these systems, and 42 percent had automated their restoration processes.