This week in cybersecurity from the editors at Cybercrime Magazine

Sausalito, Calif. – Nov. 3, 2026

The first known ransomware attack occurred in 1989, and it targeted the healthcare industry, according to a U.S. Department of Health & Human Services (HHS) presentation.

Harvard-trained evolutionary biologist and AIDS researcher Dr. Joseph L. Popp, Jr. distributed 20,000 floppy disks labelled “AIDS Information – Introductory Diskettes” to attendees of the World Health Organization’s international AIDS conference.

The disks contained a malware program that initially remained dormant in computers, only activating after a computer was powered on 90 times, at which point the Trojan, known as AIDS Trojan or PS Cyborg, hid directories and encrypted the names of the files on the recipient’s computer.

After the 90-start threshold was reached, the malware displayed a message demanding a payment of $189.

Since that first attack in 1989, ransomware has grown into a criminal enterprise that Cybersecurity Ventures projects will cost $265 billion annually by 2031.

“Ransomware Attack Examples: 50+ Major Breaches, Their Real-World Cost, and the Defenses That Reduce Organizational Exposure”, a guide published by Adaptive Security, looks at ransomware examples spanning 36 years.

What is the state of ransomware today?

Cybercriminals are leveraging artificial intelligence to enhance ransomware and cyber extortion operations, according to the SANS Institute. AI lowers the barrier for cybercriminals by enabling even low-skilled attackers to generate phishing emails, write malicious code, analyze stolen data, and negotiate ransoms using AI-driven chatbots—dramatically reducing the time, effort, and expertise required to launch sophisticated campaigns.

Cybercrime Magazine is Page ONE for Cybersecurity. Go to any of our sections to read the latest:

  • SCAM. The latest schemes, frauds, and social engineering attacks being launched on consumers globally.
  • NEWS. Breaking coverage on cyberattacks and data breaches, and the most recent privacy and security stories.
  • HACK. Another organization gets hacked every day. We tell you who, what, where, when, and why.
  • VC. Cybersecurity venture capital deal flow with the latest investment activity from various sources around the world.
  • M&A. Cybersecurity mergers and acquisitions including big tech, pure cyber, product vendors and professional services.
  • BLOG. What’s happening at Cybercrime Magazine. Plus the stories that don’t make headlines (but maybe they should).
  • PRESS. Cybersecurity industry news and press releases in real time from the editors at Business Wire.
  • PODCAST. New episodes daily on the Cybercrime Magazine Podcast feature victims, law enforcement, vendors, and cybersecurity experts.
  • RADIO. Tune into WCYB Digital Radio at Cybercrime.Radio, the first and only round-the-clock internet radio station devoted to cybersecurity.

Contact us to send story tips, feedback and suggestions, and for sponsorship opportunities and custom media productions.

The post First Ever Ransomware Attack: Dr. Joseph L. Popp, Jr., AIDS Trojan (PS Cyborg Virus), 1989 appeared first on Cybercrime Magazine.