The First Ransomware Attack: The 1989 AIDS Trojan

In December 1989, thousands of researchers, medical professionals and computer users received an unexpected package in the mail. Inside was a 5.25-inch floppy disk labelled “AIDS Information — Introductory Diskette.” The software appeared to contain an interactive questionnaire for assessing a person’s risk of HIV infection—an important and credible-sounding resource during the height of the AIDS crisis. Recipients who installed it had no obvious reason to believe they had just introduced the world’s first documented ransomware program onto their computers.

For weeks or months, the affected machines could continue functioning normally. Hidden inside the program, however, was a counter that recorded how many times the computer had started. After approximately 90 reboots, the software scrambled filenames, hid directories and presented a message declaring that the user’s software lease had expired. Restoring access supposedly required sending as much as US$378 to a company operating through a post-office box in Panama.

The program became known as the AIDS Trojan, AIDS Information Trojan or PC Cyborg Trojan. It predated email-delivered malware, cryptocurrency payments and organized ransomware gangs by decades, yet its basic strategy remains recognizable. It used a trusted subject as bait, delayed its destructive behaviour, denied access to valuable information and demanded payment for restoration. The delivery vehicle was not an email attachment but an envelope containing a floppy disk.

Quick Answer

• The AIDS Trojan is widely recognized as the first documented ransomware attack.
• Approximately 20,000 infected floppy disks were mailed internationally in December 1989.
• The disks targeted AIDS researchers, conference delegates, business readers and other mailing-list subscribers.
• The Trojan usually activated after approximately 90 computer reboots.
• It hid directories and encrypted filenames rather than encrypting the contents of every file.
• Victims were asked to pay US$189 or US$378 to the supposed PC Cyborg Corporation.
• Investigators estimated that approximately 1,000 recipients installed the disk.
• No reliable public record establishes how much ransom money was actually collected.
• Dr. Joseph Popp held a Ph.D. in evolutionary anthropology; he was not a medical doctor.
• His British prosecution ended after he was found psychologically unfit to plead.

Ransomware Before the Modern Internet

The 1989 computing environment was radically different from the one ransomware operators exploit today. Most personal computers were not continuously connected to the Internet, and many organizations exchanged programs through physical disks. Software arrived in magazines, conference packages, mailed catalogues and envelopes from vendors. Inserting a disk from an apparently credible professional source was not automatically considered reckless behaviour.

Early IBM-compatible computers commonly ran MS-DOS, a text-based operating system in which startup instructions could be placed in a file called AUTOEXEC.BAT. Hard drives were comparatively small, backups were inconsistent and many users had limited experience responding to malicious software. Antivirus products existed, but the industry was young and the vocabulary used to classify malware was still developing. The word ransomware was not the familiar cybersecurity term it is today.

The AIDS program is often called a virus, but Trojan horse is the more technically accurate description. A computer virus inserts or copies itself into other executable code so that it can replicate. The AIDS Trojan did not independently infect other programs and spread from computer to computer. Instead, it disguised malicious behaviour inside software that a recipient chose to install.

It also contained a logic bomb, meaning a malicious action triggered only after a particular condition was reached. In this case, the condition was a startup counter. The delayed activation helped separate the visible damage from the moment of installation. By the time files appeared to disappear, the original floppy disk might have been forgotten.

How the Infected Floppy Disks Were Distributed

The popular version of the story says that Joseph Popp handed infected disks directly to 20,000 people at a World Health Organization conference. The documented history is more complicated. Approximately 20,000 diskettes were posted from London in December 1989 using mailing lists that included subscribers to PC Business World, other business publications and delegates connected with international AIDS events.

Delegates from an AIDS congress held in Stockholm in October 1988 were among the people targeted, but the mass mailing occurred roughly a year later. The disks were sent through ordinary postal mail in 5.25-inch envelopes bearing first-class postage. Recipients were located across the United Kingdom, continental Europe, Africa, Scandinavia, Australia and other regions. According to contemporary reporting, no copies were intentionally mailed to the United States even though American names appeared on some of the acquired lists.

The disk was not an empty shell with an obviously fake application. It contained a functioning interactive questionnaire and risk assessment relating to HIV and AIDS. The copyright was attributed to an entity called the PC Cyborg Corporation, which had been registered in Panama. The useful-looking questionnaire provided the cover story while a separate installation component modified the computer.

This was targeted social engineering rather than simple curiosity. The recipients were selected because the subject was professionally or personally relevant to them. A disk promising AIDS information would have been considerably more persuasive to a medical researcher or conference delegate than a completely unsolicited game or novelty program. Modern attackers use the same principle when they impersonate a supplier, delivery service, executive or software vendor familiar to the intended victim.

A printed licence agreement accompanied the software and contained unusually ominous warnings. It said that PC Cyborg Corporation could use program mechanisms to terminate use and that those mechanisms could adversely affect other applications. It even warned that the computer could stop functioning normally. These statements were buried inside legalistic licence language, creating later debate over whether the consequences had technically been disclosed.

How the AIDS Trojan Worked

The disk contained two primary executable files: AIDS.EXE and INSTALL.EXE. Analyst Jim Bates found that the questionnaire program itself did not contain the malicious payload. The dangerous work was performed by INSTALL.EXE, which carried out several stages described in his original analysis as installation, counting, sharing, triggering and faking.

During installation, the Trojan created hidden directories on the computer’s C: drive. Some names incorporated ASCII character 255, which appeared as a blank space on many displays and made the directories difficult for an ordinary user to identify. The program also created control files containing counters, installation-specific serial numbers and reserved disk space. It copied components of itself to the hard drive and manipulated the machine’s startup process.

The existing AUTOEXEC.BAT file was renamed AUTO.BAT, while the Trojan created a new hidden AUTOEXEC.BAT. On every startup, this replacement launched a disguised executable before passing control to the computer’s original startup instructions. The user therefore saw the machine boot normally while the Trojan quietly incremented its counter. Bates found that activation usually occurred at around 90 reboots, although the precise value could vary.

When the trigger point was reached, the program examined filenames on the hard drive and transformed recognized names using substitution tables built into the code. File attributes were changed to hidden and read-only, while directory names were concealed. Important DOS system files were deliberately excluded so that the computer could still start and display the demand. The Trojan also filled available disk space with a control file, making the drive appear completely occupied.

The final stage simulated portions of the DOS environment. A user could type familiar commands and receive responses generated or intercepted by the Trojan, creating the impression that the operating system itself was issuing the warnings. A supposed READ.ME file informed the victim that the software lease had expired. Another visible document, CYBORG.DOC, instructed the user to renew the lease before continuing to use the computer.

Contemporary analyst Jim Bates documented these mechanisms in the January 1990 edition of Virus Bulletin. His investigation was particularly valuable because early reports incorrectly described the program as a self-replicating virus that destroyed or encrypted every file. The actual design was disruptive, deceptive and extortionate, but less cryptographically sophisticated than many accounts suggest.

Did It Really Encrypt the Victims’ Files?

The AIDS Trojan did not generally encrypt the contents of documents, spreadsheets or databases. It encrypted or substituted portions of their filenames, altered file attributes and hid directory information. Without the correct names and visible directory structure, an ordinary user could no longer locate or open the information normally. To the victim, the effect could still look like catastrophic data loss.

This distinction made the program recoverable. The transformation relied on information and substitution tables available within the malware rather than a secret key controlled exclusively by the attacker. Once investigators understood the system, they could reverse the filename changes and restore the directory structure without paying PC Cyborg Corporation.

Bates produced free recovery tools known as AIDSOUT and AIDSCLEAR, with another restoration utility referred to as CLEARAID in later accounts. AIDSOUT removed the Trojan before it triggered, while the recovery program reconstructed affected names and directories after activation. Requests for the tools reportedly came from approximately 90 countries.

Modern encryption ransomware is intentionally designed to prevent this type of recovery. A contemporary strain can generate a unique symmetric key to encrypt files rapidly, then protect that key using an attacker-controlled public key. If implemented correctly, examining the malware does not reveal the private key required for decryption. The AIDS Trojan had the extortion concept but not the robust key-management architecture that later made ransomware enormously profitable.

The Ransom Demand

PC Cyborg Corporation described its demand as a mandatory software lease rather than a ransom. Two payment levels were listed:

• US$189 for a lease covering 365 uses of the programs
• US$378 for the lifetime of the hard drive or 60 years, whichever was shorter

Payment was supposed to be mailed to a post-office box in Panama. This method was slow, physically traceable and difficult to scale. A victim could not send funds instantly and automatically receive a decryption key. Someone associated with the operation would have needed to retrieve or process the mailed payments and then supply a machine-specific renewal disk.

If every one of the approximately 20,000 recipients had paid US$378, the theoretical revenue would have been about US$7.56 million. Even a one-percent response at the lower US$189 level would have produced approximately US$37,800. Contemporary investigators estimated that duplicating, packaging and mailing the disks had already cost more than £10,000, so the operation required at least some payments simply to recover its expenses.

How much did Popp actually receive? The honest answer is that no reliable public total has been established. Later accounts sometimes imply that he earned a fortune or, at the other extreme, that nobody paid, but neither claim is supported by a complete financial record. Popp reportedly maintained that he never made money from the project, while his lawyers argued that any revenue was intended for AIDS research. Those were defence claims, not independently verified proof of his financial results or motivation.

Who Was Dr. Joseph Popp?

Joseph Lewis Popp Jr. was a genuine academic, but the title “Dr.” did not mean that he was a physician. He was an evolutionary anthropologist and biologist who received a Ph.D. from Harvard University in 1979. Before that, he studied zoology at Ohio State University, graduating with distinction in 1972. His research included years spent studying hamadryas baboons in eastern Africa.

Popp’s professional background brought him into international scientific and public-health circles. Contemporary accounts connected him with AIDS-related work in Africa and placed him at a World Health Organization seminar in Nairobi during the period surrounding the attack. His familiarity with researchers, conferences and institutional mailing lists helps explain why the bait appeared credible. It does not, however, establish a clear motive.

Claims that Popp launched the attack because he had been rejected for a permanent WHO position appear frequently in modern retellings. That explanation is plausible, but the surviving public record does not prove it conclusively. His defence argued that he intended to raise money for AIDS research, while investigators pointed to the enormous preparation, deliberate concealment and payment infrastructure as evidence of a calculated extortion attempt.

Popp’s academic intelligence also should not be confused with advanced software engineering. The malicious program was compiled using Microsoft QuickBASIC 3.0, and its encryption could be reversed once analysts understood it. Bates described the operation as elaborate but technically clumsy. It was dangerous because of its distribution, delayed trigger and psychological deception—not because it used exceptionally strong cryptography.

Investigators nevertheless found evidence closely connecting Popp with the program’s development. A seized disk reportedly contained an encrypted diary describing the project, and the key used to protect that diary was Popp’s full name. Authorities also obtained source code and evidence suggesting that planning had begun as early as April 1988. Reports claimed that preparations had been considered for an additional mailing numbering as many as two million disks.

Popp later returned to the United States and continued writing and publishing. He helped develop a tropical butterfly conservatory in Oneonta, New York, which was named in his honour after his death. His obituary described him as an evolutionary anthropologist, publisher and author. He died in 2006.

The Investigation and Failed Prosecution

The first public warnings appeared quickly once affected users compared their experiences. On December 12, 1989, a message describing the disk as a Trojan was posted to the British Compulink Information eXchange, or CIX. Within days, hundreds of messages were circulating among technical users, journalists, lawyers and malware researchers. Bates began his detailed examination while recovery utilities were distributed through bulletin-board systems and computer publications.

Investigators estimated that about five percent of recipients installed the software, representing approximately 1,000 affected computers. Not every installation reached the trigger point, and rapid distribution of recovery information limited the damage. Nevertheless, activated copies were reportedly still being discovered as much as a year later because low-use computers took longer to accumulate 90 reboots.

Some of the worst losses were caused by panic rather than direct destruction. A frequently cited incident involved an Italian AIDS organization that reportedly lost ten years of research after its affected system was erased or reformatted in an attempt to respond. Because the Trojan had not destroyed the underlying file contents, a careful forensic recovery might have preserved the information. The episode remains an early example of why unplanned incident response can magnify a cyberattack.

Popp attracted attention at Amsterdam’s Schiphol Airport on Christmas Eve 1989 while returning from a WHO event in Nairobi. Dutch authorities found him in possession of material connected with PC Cyborg Corporation but initially allowed him to continue to the United States. The FBI subsequently placed his family home in Ohio under surveillance while British authorities pursued extradition.

After a multinational investigation, Popp was extradited to the United Kingdom and faced 11 counts of blackmail. The case did not end with a conventional trial or verdict. In November 1991, a British court dismissed the proceedings after psychiatric testimony concluded that he was psychologically unfit to plead. The contemporary Virus Bulletin account of the investigation and court decision distinguishes between the extensive forensic evidence and the absence of a completed British prosecution.

It is therefore reasonable to describe Popp as the person publicly identified and forensically linked to the AIDS Trojan. It is less accurate to say that a British court convicted him of creating ransomware. The evidence was never tested through a completed trial because the case ended on competency grounds.

Were There Other Floppy-Disk Ransomware Attacks?

Floppy disks spread numerous viruses during the 1980s and 1990s, including boot-sector malware that infected a computer when someone started the machine with a contaminated disk inserted. Some erased data, corrupted storage or displayed messages. However, those programs generally did not demand payment in exchange for restoring access.

No other mass-mailed floppy-disk ransomware campaign became as historically significant as the AIDS Trojan. Its physical distribution model was expensive, slow and exposed numerous logistical clues. As computer networking and email expanded, attackers gained faster and less costly ways to reach victims. The ransomware concept survived, but the postal delivery method did not.

The next major advances came from researchers rather than criminals. In 1996, Adam Young and Moti Yung published “Cryptovirology: Extortion-Based Security Threats and Countermeasures.” Their controlled research demonstrated how public-key cryptography could create a much stronger extortion system in which only the attacker retained the private decryption key. The model closed one of the AIDS Trojan’s largest weaknesses.

File-encrypting ransomware reappeared more visibly around 2005 and 2006 through families such as GPCoder and Archiveus. These programs spread electronically and targeted the contents of documents rather than merely scrambling filenames. CryptoLocker’s emergence in 2013 then combined strong encryption, widespread online distribution and cryptocurrency payments, establishing the operational model copied by later ransomware gangs.

What the First Ransomware Attack Got Right

Although technically primitive, the AIDS Trojan introduced several features that remain central to ransomware:

1. A credible lure: The disk promised information directly relevant to its carefully selected recipients.
2. User-assisted installation: Victims executed the software themselves because they believed it was legitimate.
3. Delayed activation: The 90-reboot counter separated the visible damage from the original installation.
4. Denial of access: Files remained on the computer, but the victim could no longer use them normally.
5. A restoration offer: Payment was framed as the route to recovering the system.
6. Psychological pressure: Warnings suggested that continued use could permanently destroy the files.
7. A payment intermediary: PC Cyborg Corporation and its Panama address attempted to separate the demand from Popp personally.

Its failures are equally instructive. The recovery information was embedded in or derivable from the program, the payment channel was cumbersome and traceable, and physical distribution required substantial money and labour. The Trojan also failed to erase its forensic trail. A technically stronger successor needed remote delivery, stronger encryption and a payment method that crossed borders quickly.

Cybersecurity Lessons That Still Apply

The AIDS Trojan shows that ransomware has always depended on human trust as much as code. Recipients were not fooled because they were unintelligent. They were sent a plausible resource connected to a genuine public-health emergency and their professional interests. Social engineering works by providing a believable reason to lower normal caution.

Organizations should apply several lasting lessons:

• Treat unsolicited removable media as untrusted, even when the label appears professional.
• Maintain offline or properly isolated backups that malware cannot modify.
• Test restoration procedures instead of assuming a backup will work.
• Preserve affected systems and evidence before reformatting or reinstalling.
• Separate ordinary users from administrative privileges.
• Use application controls to prevent unknown software from executing.
• Engage qualified incident responders before paying or attempting improvised recovery.
• Remember that an attacker’s countdown and destruction warnings are designed to provoke rushed decisions.

The same principle now applies to USB drives, cloud-sharing invitations, QR codes, browser downloads and emailed documents. The medium changes, but the attacker still needs the victim to trust an object, identity or message long enough for malicious code to execute.

Conclusion

The first recorded ransomware attack did not arrive through a hacked server or anonymous cryptocurrency wallet. It arrived through the postal system on thousands of professionally labelled floppy disks. Its creator was not a career cybercriminal but a Harvard-educated evolutionary anthropologist whose exact motivations remain disputed. Its encryption was weak, its payment system was awkward and its prosecution never produced a British verdict.

Nevertheless, the AIDS Trojan contained the recognizable blueprint of modern ransomware. It used targeted social engineering, delayed execution, denial of access and a payment demand disguised as a route to recovery. Approximately 1,000 installations were suspected, yet the amount actually paid remains unknown. What survived was not a successful business model but an idea.

The most unsettling aspect of the incident is how little the psychology has changed. In 1989, the trusted object was a floppy disk promising urgent health information. Today it might be a cloud document, security update, invoice or job application. Ransomware technology has become dramatically more advanced, but its first and most important exploit remains human trust.

• Virus Bulletin: January 1990 AIDS Trojan Analysis — Read Jim Bates’s contemporary technical examination of the disk, startup modifications, trigger and recovery methods.
• IEEE Symposium Paper on Cryptovirology — Explore the 1996 research that demonstrated how public-key cryptography could enable stronger ransomware-style extortion.