AI Linked to 84 Percent of Ransomware Attacks
Left 50%
Center 50%
Right 0%
2 left · 2 center · 0 right
What happened
Cybersecurity firm Semperis released its 2026 Ransomware Risk Report, based on a Censuswide survey of 1,200 IT and security professionals across nine countries and eight industry sectors. The report said 84 percent of surveyed ransomware victims reported that attackers used artificial intelligence, 44 percent said attackers exploited the victims’ own AI systems, 69 percent experienced more than one successful attack in the prior year, 59 percent paid a ransom at least once, and 87 percent saw attacks on identity systems. More than a third of surveyed victims reported psychological or physical threats against employees, and 14 percent said employees or family members had to change jobs, offices, or residences. Former White House National Cyber Director Chris Inglis, a Semperis board member, said AI is expanding attackers’ capacity and that autonomous ransomware attacks are already occurring. The New York Times separately reported a wave of ransomware attacks on Japanese critical infrastructure that experts said AI may be making easier.
Sourcing check · Mostly on the record · 4 articles
2 of 3 articles cite a named source for the story. It started with unnamed sources; a named source appeared 13 hours later.
What these terms mean and how they're counted
- On the record · names a source 2 of 3
- On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: Semperis and Chris Inglis
- Primary evidence · cites a document or data 1 of 3
- Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: research report
- Credits another outlet 0 of 3
- The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: Each article presents its own reporting.
- Unnamed sources 1 of 3
- The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this. Here: e.g. “experts say”
- How it developed
- When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Oct 13, 21:22 UTC by New York Times, with no named source. First named source 13 hours later, from CBS News. First document 13 hours later, from CBS News (research report).
- Not counted 1
- Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
ONE-SIDED THIS WEEK.
Only left-leaning outlets have covered this story in the last two days;
Breitbart reported it on 2026-10-06.
Omitted — what each side leaves out
Unpacked
Right-leaning outlets had not covered this as of publication, so a reader there never encounters the AI-ransomware link. Left-leaning coverage reports that link but disagrees on what the story is. The Hill leads with a global victim survey, while the Times leads with attacks that have swept Japan and hit critical infrastructure. Neither account includes the other's central fact, so each left reader — and every reader of the silent side — is missing half or all of it.
Left-leaning coverage also parts on how sure it sounds. The Times hedges that AI "May Be Making Them Easier," while The Hill treats victim reports of weaponized AI as the news itself.
Did forensic teams confirm that attackers used AI, or did victims only infer it?
Bottom line
Right-leaning outlets have not reported the finding that 84 percent of surveyed ransomware victims tied attacks to AI. Left-leaning coverage splits that number from the Times account of attacks on Japanese critical infrastructure, so a reader of any single outlet does not get both.
The receipts — 5 facts one side's coverage lacks
- Critical infrastructure in Japan has been targeted in a wave of cyberattacks that experts say are rising because of artificial intelligence.
- 84 percent of surveyed ransomware victims reported that attackers had weaponized artificial intelligence.
- 44 percent of surveyed victims reported that attackers exploited their own AI systems.
- 87 percent of surveyed victims experienced attacks targeting identity systems.
- Former White House National Cyber Director Chris Inglis said autonomous ransomware attacks are already included in the mix.
The Left View
The New York Times framed a wave of ransomware against Japanese critical infrastructure as part of a broader rise in attacks that experts link to artificial intelligence. The Hill and CBS News both led with the Semperis finding that 84 percent of surveyed ransomware victims said attackers had weaponized AI. CBS presented the report as evidence of an evolved criminal enterprise that uses AI to find weaknesses, tailor social engineering, automate intrusions, and lower the skill needed to launch attacks, quoting Inglis on “democratized” AI and Semperis’s Tomer Bar on faster malware development and harder attribution. CBS also highlighted that 44 percent of victims said their own AI systems were exploited, the human toll of threats to employees and families, and a warning from Semperis’s Courtney Guss that corporate AI agents can seek extra permissions and become a path into identity systems. Coverage treated the survey as a turning point while also quoting Inglis that many underlying access weaknesses predate AI and that organizations should use AI defensively.
Our Take (balanced)
The story is substantive as a named-company survey with specific figures, a stated sample, and on-the-record experts, not an unsourced leak. What is established is that Semperis and Censuswide surveyed 1,200 IT and security professionals and published those percentages, and that Inglis and Semperis executives made the quoted claims. What remains unverified independently is that AI caused or enabled any given attack, that 84 percent of real-world ransomware now involves AI, or that autonomous ransomware is already widespread—those rest on victim self-reports and a vendor-linked report, not public forensic evidence. No right-leaning outlet has reported this. Watch for the full survey methodology and any raw data, independent incident reports or government cyber agencies confirming AI-assisted campaigns, technical samples of AI-generated ransomware, and official Japanese responses on the infrastructure attacks.
4 sources
More stories
The week's bottom lines, in your inbox
One email a week: the five stories that mattered and what they actually mean. Free.