Sextortion: The Threat to Individuals, Families, and Organisations
Sextortion destroys individual lives before it ever becomes an organisational problem. Understanding who is targeted, how campaigns operate, and what effective response looks like at every level.
Most sextortion victims are not executives or corporate employees. They are teenagers, young adults, parents, and ordinary people navigating digital relationships. A teenager is befriended on a gaming platform or social media, manipulated into sharing intimate images, and then told to pay or the images will be sent to every contact in their phone. An adult in a new online relationship discovers the intimacy was engineered from the start. The psychological impact is immediate and severe. Shame, fear, and isolation are the intended effects, because they prevent the victim from seeking help. That isolation is not incidental. It is the mechanism.
Sextortion has undergone a structural transformation. What was once opportunistic crime committed by individuals is now an industrialised operation run by transnational organised crime networks. These groups operate with the efficiency of a call centre: scripts, target lists, success metrics, and defined payment thresholds. Victims are not selected because of who they are. They are selected because they are available and responsive. The volume is industrial; the harm is personal.
The scope of targeting is genuinely universal. Campaigns do not distinguish by age, profession, gender, or social standing. Teenagers are targeted because they are susceptible to relationship manipulation and terrified of parental discovery. Adults are targeted because they carry more to lose reputationally. Senior executives and public figures are targeted because the leverage is higher and the payment potential greater. Every demographic is in scope. The campaign mechanics differ; the coercive structure does not.
At the organisational level, the harm extends beyond the individual victim. An employee under active extortion is under external coercive control. They may be pressured to share access, provide documents, or create internal vulnerabilities they would otherwise refuse. The personal victimisation becomes an institutional attack vector. Most security and HR frameworks address neither the individual nor the organisational dimension adequately, because they treat sextortion as a welfare matter rather than a compound risk event.
Effective response at the individual level requires removing shame from disclosure and providing clear, practical guidance on what to do and what not to do in the first hours: do not pay, do not delete evidence, do not comply, and seek specialist support immediately. At the organisational level, it requires disclosure pathways that protect affected employees, rapid-response protocols that treat the event as a security incident, and management structures that do not punish people for being targeted.
"The first objective of every sextortion campaign is isolation. As long as the victim believes they are alone in this, the campaign is working. That is why the single most important intervention, at every level, is removing the conditions that make silence feel like the only option."
Custodia One Advisory Perspective
What Your Organisation Should Do
Individuals: do not pay, do not delete communications or evidence, and report to a specialist or law enforcement immediately
Parents and educators: create environments where young people feel able to disclose without fear of punishment or shame
Organisations: build anonymous disclosure pathways and treat employee sextortion as a compound personal and security event
Everyone: understand that the shame and isolation you are feeling is the designed outcome of the attack, not a reflection of fault
Advisory Enquiries
Facing this issue in your organisation?
Custodia One advises on all of the issues covered in our Intelligence Library. Contact us to discuss your specific situation in confidence.