A floppy disk launched world's first ransomware attack 35 years ago

Through the looking glass: As the clock struck midnight on January 1, 1990, the world unknowingly stepped into a new chapter of digital threats. Few realized that the largest cybercrime investigation of its time was about to unfold, sparked by what would come to be known as the world's first ransomware.

The attack, masterminded by American biologist Dr. Joseph Lewis Andrew Popp Jr., arrived via a seemingly innocuous 5.25-inch floppy disk labeled "AIDS Information – Introductory Diskette 2.0." This digital Trojan horse found its way into the hands of approximately 20,000 unsuspecting victims, including subscribers of PC Business World magazine, various mailing list recipients, and even delegates attending a World Health Organization conference on AIDS.

The attack was carefully timed to exploit the global anxiety surrounding the AIDS epidemic. In the late 1980s, AIDS was instilling fear and uncertainty in populations around the world. At the same time, awareness of computer viruses was minimal, let alone the concept of malware designed for extortion. Dr. Popp exploited this confluence of health anxiety and technological naivety.

While crude by today's standards, the "AIDS Information" ransomware was groundbreaking for its time. The malware encrypted file names rather than the files themselves. This proved to be a crucial weakness, allowing for countermeasures to be developed. Two software tools, "AIDSOUT" and "AIDSCLEAR," were swiftly created by John Sutcliffe and Jim Bates to combat the threat and assist affected users.

Despite these remedies, several organizations suffered significant financial losses and data destruction from the attacks. One of the most severe cases involved an Italian health organization, which reportedly lost a decade of invaluable research data to the malicious program.

Dr. Popp was eventually caught and following his arrest and extradition, the 41-year-old biologist exhibited a series of bizarre behaviors that led to him being declared mentally unfit to stand trial by a London psychiatrist. Eyewitness accounts described Popp wearing condoms on his nose, carrying a cardboard box, and engaging in other eccentric actions. This behavior ultimately landed him in London's Maudsley Hospital instead of prison.

However, the sophistication of the attack, as well as the significant financial investment required to carry it out, raises questions about Popp's alleged mental state. The distribution costs alone were estimated at £10,000 – equivalent to approximately £31,794.86, or $38,600, in today's currency. Additional expenses included registering the "PC Cyborg" company in Panama and securing accommodation in London.

Despite these substantial upfront costs, the potential returns were considerable. The ransom demands were structured such that even if only 1 percent of the victims paid, the operation would yield a handsome profit.