How ransomware evolved from floppy disks to extortion

1989: the idea

The first known ransomware arrived on floppy disks mailed to researchers. It scrambled file names and asked for money by post. The scrambling was easy to undo. (Read the story.)

2013: strong encryption and digital payments

A strain called CryptoLocker combined two things that made ransomware a business: encryption that could not be broken, and payment in Bitcoin, which was harder to trace than a bank transfer. It spread through email attachments. For the first time, without a backup, the only way to get files back was to pay. (Read the story.)

2017: ransomware that spreads itself

WannaCry and NotPetya spread from computer to computer through network flaws, with nobody clicking anything. Whole organizations went down in hours. (WannaCry, NotPetya.)

2019 onward: steal first, then encrypt

Businesses with good backups were refusing to pay. Criminal groups answered by copying data out before encrypting it, then threatening to publish it. This is often called double extortion. Backups alone no longer covered the risk.

Today: ransomware as a business model

Many attacks are now run like franchises. One group writes the ransomware and rents it out. Others, sometimes called affiliates, break into businesses and share the payments. Some specialize in getting in and sell that access to the rest. Attacks are aimed at whoever is easiest to reach, not just large companies.

What this means for a business

• Stop the way in: multi-factor authentication, email protection and prompt updates.
• Catch it early: most attacks spend days inside before encrypting. Detection and response, with people watching, is how they get caught.
• Be able to recover: backups the attackers cannot reach, tested so you know they work.