Semperis releases its 2026 ransomware report: include identity in recovery planning
New findings raise questions about AD, Entra ID and identity backups. Keep survey proportions within scope; do not generalize them to Vietnam.
Updated: · Vietnam time (UTC+7)
Semperis' release and report page were checked; the underlying survey data has not been independently audited.
Released on 14 October 2026. Semperis says the sample includes only organizations hit by ransomware in the preceding 12 months, not all businesses.
New publication and sample scope
Semperis released its annual report on 14 October. Its sample is restricted to organizations hit by ransomware in the preceding 12 months, so it cannot estimate any arbitrary organization's probability of attack. [S1]
Identity and recovery readiness
Within the survey sample, Semperis reports that 87% of attacks targeted identity systems and 50% of organizations had dedicated identity backups. These are vendor-reported findings, not Ransomware.VN's independent measurements or Vietnam statistics. [S2]
Editorial assessment: rehearse data and access recovery
IT teams can turn the report into a testable question: if identity services fail, who can access recovery copies, verify a clean environment and bring applications back? This is editorial advice; the survey does not guarantee any particular recovery method.
- Inventory dependencies among applications, service accounts and identity infrastructure.
- Test emergency access in an isolated environment, with logging and privilege controls.
- Rehearse dependency-based restoration and verify login, authorization and business workflows.
- Do not use survey proportions or AI-use claims to attribute an actual incident.
Sources
Each source's scope and date are recorded separately when available. A citation does not independently verify every assessment.
Update history
· Published from public sources, with source dates and verification limits stated separately.
Corrections policy
