A family’s ordinary afternoon was shattered when an unknown number added multiple relatives, including a teenager, to a group chat and shared what appeared to be AI-generated explicit images of a family member, the Wall Street Journal (WSJ) reported. The goal was simple: to extort money by threatening to release the images more widely. The scheme was sophisticated, leveraging publicly available social media photos and AI tools to fabricate convincing pornographic content and to map out family relationships for maximum emotional impact.
Why This Matters for Your Organization
Sextortion, generally speaking, is the use of real or fabricated explicit images to coerce victims into paying money. According to reports, the practice is accelerating, and AI is the catalyst. Scammers no longer need to manually research their targets. Open-weight AI models running on dedicated machines can scrape social media profiles, analyze public data, and piece together personal relationships at scale.
What does this mean for organizations? Whether the target is the employee or the organization, the organization could face significant disruption to the business, distracted employees, and reputational harm. Reported tactics by online extortionists include threats to post or send explicit imagery of employees in places online designed to be seen by the organization and its customers, such as social media platforms or, as in the scenario reported in the WSJ, by group text. Much the same as threat actors who plan spear phishing attacks, sextortionists do their research in order to understand and leverage their victims’ connections. The result could be a demand to the organization for large sums paid in cryptocurrency, in exchange for keeping the images fake though they may be, out of the public eye.
In addition to facing an extortion demand and the risk of harm to the brand and reputation, organizations also need to consider the impact on the victim employee(s). These kinds of attacks can cause the subject employees severe emotional distress distracting them from their job. The employee’s personal and business accounts, including email, also may have been compromised, helping the threat actor to expand the impact of the attack.
Are You Prepared?
Many organizations have robust cybersecurity protocols for protecting corporate systems, but far fewer address the human side of digital exploitation. Here are the questions every organization should be asking today:
- Do your employees know what sextortion looks like? Many people still assume they aren’t targets because they aren’t wealthy or famous. The reality is that these AI-driven scams are automated and opportunistic— no one is too small a target. Consider updating your training programs to address this threat.
- Does your security awareness training cover AI-generated threats? Traditional phishing training may not address the emotional manipulation involved in sextortion or the use of deep-fake technology to create convincing explicit images.
- Do your employees know what to do if it happens to them? Experts, including the FBI, advise victims not to pay, to block and report the scammer to the FBI’s Internet Crime Complaint Center, and to immediately change passwords and end unknown device sessions. Does your organization have clear guidance or an employee assistance program that covers this type of incident?
- Are you encouraging good digital hygiene? Simple steps—setting social media accounts to private, using strong and unique passwords, and enabling two-factor authentication—can significantly reduce exposure.
- Does your incident response plan address this threat? Preparedness is critical for any significant business threat. In addition to ensuring there is a clear path for employees to report these incidents confidentially, whether they occur through personal or corporate channels, businesses should expand their incident response plan. They also should practice how they might respond to such an attack, which would know knowing what resources they have to provide support for the organization and affected employees.
The Bottom Line
AI is supercharging old scams into something faster, more convincing, and more invasive. Sextortion is no longer a risk that only affects teenagers or public figures. It can reach anyone through any group chat, at any time. Organizations should consider this risk and improve preparedness.