AIDS Trojan: The First Ransomware Arrived on a Floppy Disk
In 1989, 20,000 floppy disks sent by mail ushered in the era of ransomware. The story of an AIDS Trojan, an eccentric biologist, and a ransom paid to a safe deposit box in Panama.
- AUTHOR
- Karol Rapacz / Penetration Tester (OSCP, PNPT)
- PUBLISHED
- 26 June 2026
- READING TIME
- 12 min read
- TOPIC
- History
Ransomware seems to be the problem of our times - bitcoin, criminal groups, attacks on hospitals and factories. Meanwhile, the first ever attack of this type occurred in 1989, long before the widespread Internet, and its “infection vector” was ordinary mail. What was behind the whole thing was not a gang of cybercriminals, but an eccentric biologist from Harvard. This is the story of the AIDS Trojan - bizarre, ahead of its time, and, as it turns out, astonishingly instructive, because even then it contained in embryo all the elements that fuel today’s plague.
20 thousand envelopes
At the end of 1989, approximately twenty thousand people around the world - doctors, researchers, health-related institutions, participants of the WHO AIDS conference - received a shipment. Inside was a diskette labeled “AIDS Information - Introductory Diskettes”, promising a program that assessed HIV risk based on a survey. In an era when the AIDS epidemic was causing great concern, the topic was catchy and the sender looked credible. Many people have inserted a floppy disk into their computer.
And indeed - the program displayed a survey and counted the “risk”. But he also did something else. It silently installed itself in the system and started counting computer starts.
Time bomb
The AIDS Trojan didn’t strike right away - and that was its insidious masterpiece. He waited for the computer to boot 90 times. Only then did it activate the payload: hiding directories and encrypting (actually obfuscating) filenames on disk, rendering the system unusable. A request appeared on the screen: to regain access, you must “renew your software license” by sending $189 (or $378 for the lifetime version) to the PO box of “PC Cyborg Corporation” in Panama.
And there it was - the first ransomware in history. It already contained all the classic ingredients that we recognize today:
- loss of access to data as leverage,
- ransom demand for restoration,
- anonymous payment channel (then a safe deposit box in Panama, today cryptocurrencies).
Only the medium and scale have changed. The idea was identical.
An eccentric creator
The author was Dr. Joseph Popp, a Harvard-educated biologist and researcher. His motives remain unclear to this day - there were financial and personal issues, and his behavior after his arrest was so unusual that he was deemed incompetent to stand trial. (According to reports, he wore a box on his head for fear of radiation.) Regardless of his motivation, Popp went down in history as the creator of the first ransomware - a bizarre figure at the beginning of a phenomenon that decades later became one of the most serious threats to the economy.
Why the attack (thankfully) wasn’t perfect
AIDS Trojan had a fundamental weakness that today makes it almost benign: the “cryptography” used was symmetric and weak. The decryption key could be extracted from the code itself, so researchers quickly developed tools to restore files without paying a ransom. Victims did not have to send money to Panama.
And herein lies the most important difference between 1989 and today. Modern ransomware uses strong asymmetric cryptography, in which the decryption key cannot be extracted from the attacked machine - it is only with the attacker. It was one technical change that turned a curiosity into a plague: as long as encryption was weak, ransomware was harmless; when it became strong, it became a weapon. More about modern defense in ransomware: how to defend yourself.
What does this story say about the nature of the problem
AIDS Trojan teaches something deeper than just “ransomware is old”:
- The core of the attack has not changed. Since 1989, the media (floppy disk → email → exploit), cryptography (weak → strong) and payments (locker → bitcoin) have changed, but the pattern has remained identical: cut off the victim’s access to what is important to him and demand payment. Anyone who understands this pattern understands ransomware, regardless of the decade.
- Social engineering was here from the beginning. The attack was not about brilliant code, but about catchy bait (“information about AIDS”) at a time when the topic aroused fear. The same mechanics - tapping into emotions and current fears - drive phishing today.
- Patience is a weapon. Waiting 90 reboots made it difficult to pin the infection to a specific diskette. Modern attacks can also wait for weeks before striking.
Lessons for companies
- Backups are the best anti-ransomware policy. If the 1989 victims had copies, the ransom demand would be meaningless. Today, the tested, offline 3-2-1 strategy is the difference between rebuilding and paying.
- Do not trust external media and attachments. The floppy disk was replaced by an e-mail attachment and a pendrive, but the principle is the same: unknown source = untrusted.
- Be careful of baits that play on emotions and news. A catchy, “important” topic is a classic social engineering signal.
- Have a plan for what-ifs. Knowing how to respond when data is encrypted reduces chaos - see leak/incident response.
Summary
The first ransomware in history didn’t come from the Internet - it came by mail, on a floppy disk, from an eccentric biologist, and demanded a ransom for a safe deposit box in Panama. The 1989 AIDS Trojan was technically primitive and, fortunately, easy to defeat because its cryptography was weak. But it already contained the entire genetic code of a phenomenon that would paralyze hospitals and corporations decades later: cut off access, demand payment, hide behind an anonymous channel. The only thing that separated a curiosity from a plague was the strength of encryption. It’s a sobering lesson: the most dangerous threats are rarely new - they’re old ideas with better technology.
Want to see if your company could survive a ransomware attack - from backup resiliency to viable entry paths? Contact us - audits and penetration tests show this in advance.
Frequently asked questions (FAQ)
Was AIDS Trojan really the first ransomware? Yes, it is widely considered to be the first ransomware attack. In 1989, long before the Internet became widespread, he was the first to combine data loss with a ransom demand and an anonymous payment channel - all defining features of this class of attacks.
Why didn’t victims have to pay the ransom? Because the cryptography used was weak and symmetric - the key needed for decryption could be extracted from the malicious code itself. Researchers quickly created tools to restore files without paying. This is a fundamental difference from today’s ransomware, which uses strong asymmetric encryption, making data recovery impossible without the attacker’s key.
What does AIDS Trojan have in common with today’s ransomware? The scheme: cut off the victim from their data and demand payment to restore access, hiding behind an anonymous payment channel. The media have changed (floppy disk → e-mail/exploit), encryption strength and form of payment (post office box → cryptocurrencies), but the essence of the attack has remained identical since 1989.
What’s the best way to protect yourself against ransomware today? The single most effective defense is tested, offline backups - once you have something to restore the data from, the ransom demand is no longer valid. In addition, there are: rapid patching, network segmentation, strong authentication, permission restriction and a ready-made response plan. Paying the ransom does not guarantee data recovery and finances crime.
