A timeline of the biggest ransomware attacks

The history of technology is riddled with unintended consequences. As William Gibson wrote in Burning Chrome, "...the street finds its own uses for things." Though Bitcoin may not have been originally conceived as a medium for ransom payments, it's quickly become a central tool for online criminals.

Ransomware, a category of "malware," blocks access to a computer or network until a ransom is paid. Despite the evolving efforts of governments to regulate cryptocurrency and mitigate its role in ransomware payments, the attacks keep coming. 

Cryptocurrency ransomware payments totaled roughly $350 million in 2020, according to Chainanalysis -- an annual increase of over 300% from 2019. And because US companies are legally required to report cyberattacks only if customers' personal information is compromised, that estimate may be far too conservative.

Read more: The history of hacking ransoms and cryptocurrency

Below, we tally up the damage of some of the highest-profile episodes.

Kaseya (2021)

On July 2, 2021, Kaseya announced its systems had been infiltrated. Kaseya provides IT solutions for other companies -- an ideal target which, in a domino effect, ended up impacting approximately 1,500 organizations in multiple countries. REvil, a cybercriminal outfit, claimed responsibility for the attack and demanded ransoms ranging from a few thousand dollars to multiple millions, according to a Reuters report. 

It's unclear how many individual businesses paid up, but REvil demanded $70 million in bitcoin from Kaseya. Kaseya declined to pay, opting to cooperate with the FBI and the US Cybersecurity and Infrastructure Agency. On July 21, 2021, Kaseya obtained a universal decryptor key and distributed it to organizations impacted by the attack.

JBS (2021)

On May 31, 2021, JBS USA, one of the largest meat suppliers in the US, disclosed a hack that caused it to temporarily halt operations at its five largest US-based plants. The ransomware attack also disrupted the company's Australia and UK operations. JBS paid the hackers an $11 million ransom in Bitcoin to prevent further disruption and limit the impact on grocery stores and restaurants. The FBI attributed the hack to REvil, a sophisticated criminal ring well-known in ransomware attacks. 

Colonial Pipeline (2021)

On May 7, 2021, America's largest "refined products" pipeline went offline after a hacking group called Darkside infiltrated it with ransomware. Colonial Pipeline covers over 5,500 miles and transports more than 100 million gallons of fuel daily. The impact of the attack was significant: In the days that followed, the average price of a gallon of gas in the US increased to more than $3 for the first time in seven years as drivers rushed to the pumps. 

The pipeline operator said it paid the hackers $4.4 million in cryptocurrency. On June 7, 2021, the DOJ announced it had recovered part of the ransom. US law enforcement officials were able to track the payment and take back $2.3 million using a private key for a cryptocurrency wallet.

Brenntag (2021)

On April 28, 2021, German chemical distributor Brenntag learned it was the target of a cyberattack by Darkside, which stole 150GB of data that it threatened to leak if ransom demands weren't met. After negotiating with the criminals, Brenntag ended up negotiating the original ransom of $7.5 million down to $4.4 million, which it paid on May 11.

CNA Financial (2021)

On March 23, 2021, CNA Financial, the seventh largest commercial insurer in the US, disclosed it had "sustained a sophisticated cybersecurity attack." The attack was carried out by a group called Phoenix, which used ransomware known as Phoenix Locker. CNA Financial eventually paid $40 million in May to get the data back. While CNA has been tight-lipped on the details of the negotiation and transaction, but says all of its systems have since been fully restored. 

CWT (2020)

On July 31, 2020, US business travel management firm CWT disclosed it had been impacted by a ransomware attack that infected its systems -- and that it had paid the ransom. Using ransomware called Ragnar Locker, the assailants claimed to have stolen sensitive corporate files and knocked 30,000 company computers offline. 

As a service provider to one-third of S&P 500 companies, the data release could have been disastrous for CWT's business. As such, the company paid the hackers about $4.5 million on July 28, a few days before Reuters reported the incident. 

University of California at San Francisco (2020)

On June 3, 2020, the University of California at San Francisco disclosed that the UCSF School of Medicine's IT systems had been compromised by a hacking collective called Netwalker on June 1. The medical research institution had been working on a cure for COVID.

Apparently, Netwalker had researched UCFS, hoping to gain insights into its finances. Citing the billions of dollars UCFS reports in annual revenue, Netwalker demanded a $3 million ransom payment. After negotiations, UCSF paid Netwalker the bitcoin equivalent of $1,140,895 to resolve the cyberattack. According to the BBC, Netwalker was also identified as the culprit in at least two other 2020 ransomware attacks targeting universities. 

Travelex (2019)

On New Year's Eve 2019, London-based foreign currency exchange Travelex was infiltrated by a ransomware group called Sodinokibi (aka REvil). The attackers made off with 5GB of customer data, including dates of birth, credit card information, and insurance details. Travelex took down its website in 30 countries in an attempt to contain the virus.

In the wake of the ransomware attack, Travelex struggled with customer services. Sodinokibi initially demanded a payment of $6 million (£4.6 million). After negotiations, Travelex paid the cybercriminals $2.3 million (285 BTC at the time, roughly £1.6 million) to get its data back.

WannaCry (2017)

In May 2017, a ransomware called WannaCry infected computers across the globe by exploiting a vulnerability in Windows PCs. The WannaCry vulnerability was revealed during a massive leak of NSA documents and hacking tools engineered by a group called Shadow Brokers in April 2017. 

Though the exact number of WannaCry victims remains unknown, more than 200,000 computers around the world were infected. Victims included Spanish telecommunications company Telefónica and thousands of hospitals in the UK. Computer systems in 150 countries were affected by the attack, with a total estimated loss of around $4 billion globally.

The attackers initially demanded $300 in bitcoin to unlock infected computer systems. The demand was later increased to $600 in bitcoin. However, some researchers claim that no one got their data back, even if they met the demands.

WannaCry attacks continue to this day. In February 2021, the DOJ indicted three North Korean computer programmers for their alleged role in the WannaCry outbreak.

Locky (2016)

Discovered in February 2016, Locky is notable due to the incredibly high number of infection attempts it's made on computer networks. Attacks typically come in the form of an email with an invoice attached from someone claiming to be a company employee. On February 16, 2016 analysis from Check Point identified more than 50,000 Locky attacks in one day. 

Locky has many variants, but the goal is largely the same: Lock computer files to entice owners to pay a ransom in cryptocurrency in exchange for a decryption tool, which would allow users to regain access to their locked files. The majority of Locky victims have been in the US, and especially among health care companies, but Canada and France experienced significant infection rates as well. 

TeslaCrypt (2015)

Modeled on an earlier program called CryptoLocker, the earliest TeslaCrypt samples were circulated in November 2014 but the ransomware was not widely distributed until March of the following year.

TeslaCrypt initially targeted gamers. After infecting a computer, a pop-up would direct a user to pay a $500 ransom in bitcoin for a decryption key to unlock the infected system. Other sources report the requested ransoms ranged from $250 to $1000 in Bitcoin. In May 2016, the developers of TeslaCrypt released a master decryption key for affected users to unlock their computers.

CryptoWall (2014)

Widespread reports of computer systems infected from the CryptoWall ransomware emerged in 2014. Infected computers were unable to access files -- unless the owner paid for access to a decryption program. CryptoWall impacted systems across the globe. The attackers demanded payment in the form of prepaid cards or bitcoin. CryptoWall caused roughly $18 million in damages, according to Help Net Security. Multiple versions of CryptoWall were released, with each version making the ransomware more difficult to trace and combat.

CryptoLocker (2013)

The first time much of the world heard the term "ransomware" was during 2013's CryptoLocker outbreak. Discovered early in September 2013, CryptoLocker would cripple more than 250,000 computer systems during the following four months. Victims were instructed to send payments in cryptocurrency or money cards to regain access. The ransomware delivered at least $3 million to its perpetrators. 

A multinational law enforcement effort in 2014 succeeded in taking down the Gameover ZeuS botnet, which was a primary distribution method for CryptoLocker. The DOJ indicted Russian hacker Evgeniy Mikhailovich Bogachev, as the botnet's ringleader. Bogachev is still at large -- and the FBI is currently offering a reward of up to $3 million for information leading to his arrest and/or conviction. 

AIDS Trojan/PC Cyborg (1989)

Widely considered the template for all subsequent attacks, the AIDS Trojan (aka PC Cyborg) is the first known instance of a ransomware attack. In 1989, more than a decade before the creation of bitcoin, a biologist named Joseph Popp distributed 20,000 floppy disks at the World Health Organization AIDS conference in Stockholm. The floppy disks were labeled "AIDS Information - Introductory Diskettes" and contained a trojan virus that installed itself on MS-DOS systems.

Once the virus was on a computer, it counted the times the computer booted up. Once the computer booted up 90 times, the virus hid all directories and encrypted filenames. An image on the screen from the 'PC Cyborg Corporation' directed users to mail $189 to a PO address in Panama. The decryption process was relatively simple, however, and security researchers released a free tool to help victims.