Ransomware may feel like a modern threat, but the idea of holding computer access or files hostage has been around for decades. What started as a strange experiment on floppy disks has grown into a global criminal business that affects individuals, businesses, schools, hospitals, local governments, and critical infrastructure.

Understanding the history of ransomware helps explain why backups, updates, strong passwords, and careful clicking matter so much today.

This week's issue brings the return of recognizing our weekly "Cybersecurity All-Stars". I had stopped doing this for some reason. So, beginning this week that error will be corrected.

Week of August 3 - August 10

This week's "Cybersecurity All-Stars" are Chris Hines, Maria Kullman & Staci King.

Well done. Stop by the IT Department to claim your All-Star merch and show off your cybersecurity skills to your work mates.

Ransomware is malicious software that blocks access to files, devices, or networks and demands payment for their return. Early ransomware was relatively crude, but modern ransomware can encrypt entire networks, steal data, threaten public exposure, and disrupt essential services. The basic idea has stayed the same: criminals create pressure by taking something valuable away and demanding money to give it back.

The first widely recognized ransomware attack appeared in 1989. It was distributed on floppy disks that were mailed to people connected with an international AIDS conference. After the infected computer had been restarted a certain number of times, the malware hid directories, scrambled file names, and demanded payment to restore access.

By today’s standards, the attack was simple and the encryption was weak. Victims were instructed to send money through the mail rather than pay online. Still, it introduced a dangerous concept: a criminal could use software to hold a computer hostage and demand payment. That idea would eventually become one of the most serious cyber threats in the world.

For many years, ransomware was not common because criminals had two big problems: spreading the malware widely and collecting payment. As more people connected to the internet and email became routine, attackers had better ways to reach victims. Early ransomware families began using stronger encryption and more convincing messages. Some attacks pretended to be security tools, software fixes, or warnings that the computer had a serious problem.

This period helped prove the business model. If criminals could scare people, lock something important, and make payment possible, some victims would pay. Ransomware was still far from the industrial-scale threat we know today, but the pieces were coming together.

One of the biggest turning points came with the growth of cryptocurrency. Before cryptocurrency, collecting ransom payments was risky and awkward. Criminals had to rely on wire transfers, prepaid cards, online payment services, or even postal mail. Cryptocurrency gave attackers a faster way to demand payment from victims around the world while making the money trail more difficult to follow.

This did not make criminals invisible, but it did make ransomware more profitable and easier to scale. Once criminals had a workable payment method, ransomware quickly became more attractive to organized cybercrime groups.

CryptoLocker, which appeared in 2013, is often remembered as a major turning point. It used strong encryption, spread through malicious email attachments and botnets, and demanded payment in Bitcoin. For many victims, the encryption was difficult or impossible to break without the attacker’s key. CryptoLocker showed criminals that ransomware could produce large profits when technical pressure and convenient payment methods were combined.

After CryptoLocker, ransomware became more professional. Criminal groups improved their messages, payment instructions, encryption methods, and delivery techniques. Some even created help desks to walk victims through buying cryptocurrency and paying the ransom. Ransomware was no longer just a nuisance. It had become a business.

In 2017, two major incidents showed how far ransomware-style attacks could spread. WannaCry used a software vulnerability to move rapidly across networks and affected organizations around the world, including hospitals and public services. Soon after, NotPetya spread through trusted software update channels and caused massive disruption. Although NotPetya looked like ransomware, it behaved more like destructive malware because many victims could not realistically recover by paying.

These events changed how many organizations viewed ransomware. It was no longer only about individual computers or small businesses. Ransomware could disrupt healthcare, transportation, shipping, manufacturing, government services, and other critical operations. It also showed why patching known vulnerabilities quickly is so important.

As defenses improved, many criminals shifted from random attacks to targeted attacks against larger organizations. This became known as “big game hunting.” Instead of asking one home user for a few hundred dollars, attackers targeted companies, schools, hospitals, municipalities, and service providers that could suffer major disruption if systems went down.

Ransomware-as-a-service also changed the landscape. Skilled developers created ransomware tools and leased them to affiliates, who carried out attacks and shared the profits. This lowered the barrier to entry and made ransomware more like an underground business ecosystem, with developers, affiliates, access brokers, negotiators, leak sites, and money-laundering services.

Modern ransomware often includes data theft. Attackers break in, copy sensitive information, and then encrypt systems. If the victim refuses to pay, the criminals may threaten to publish the stolen data. This is called double extortion because the victim faces two pressures: loss of access and possible exposure of private information.

Some attackers now focus on extortion even without encrypting files. If they can steal enough valuable data, the threat of public release may be enough to demand payment. This shift is one reason ransomware is often discussed together with data breaches.

The history of ransomware shows that criminals adapt to technology. When floppy disks were common, ransomware used floppy disks. When email became common, ransomware used email. When cryptocurrency became available, ransom payments became easier to demand. When backups improved, criminals added data theft and public shaming. Each step in the history of ransomware is really a lesson in adaptation.

The best defense also has to adapt. Strong backups, software updates, multi-factor authentication, careful clicking, limited administrator access, network monitoring, and incident response planning all work together. For individuals and organizations, preparation is just as important as prevention.

We are taking next week and a new issue of "Cybersecurity Friday" will arrive on September 4, 2026. This will be a very special issue as it will be our 200th!