Ransomware is software that gets introduced to usually a company's data systems
by a malicious actor (who wrote the program) and a generally unwitting victim (who downloaded or
activated it). The victim clicks a link in an e-mail message or a web page, and that click connects
that person's computer to a computer elsewhere, which transmits a file back to the requesting machine.
Like almost any computer virus, the file spreads itself to all the other machines on the local
network. Ransomware programs differ in that they encrypt the contents of the hard drives and advise
the victim that they must follow a series of instructions to purchase the decryption key. Some versions
demand payment be made within a specific amount of time; others increase the cost of the key as
time passes. Given the strength of modern encryption algorithms, the data is lost without the key.
In this way, the affected machines are being held for ransom by the software — hence, "ransomware."
Ransomware is also something that I read about in tech news stories and summaries. It's...
it's a far-off thing for most — something we've heard of like so many bad things in
our world, but it's never close enough to be... real.
Well, here's reality: I've just learned of a friend whose company was struck by a ransomware attack. I
don't know any details beyond that, except to say that if the company is unable to meet the
captor's demands, it could go under.
I don't want to see my friend out of work, especially due to something like this. In the IT
world, the job market is volatile enough without threats like these. Why,
in my own resume I mention, as a final bullet under certain employers, the circumstances
of my departure: layoffs, end of contract, that sort of thing. Way back in my history I
do have an instance where the company I'd worked for for several years closed. It's far
enough back now where I don't generally have to reference it, but back when I did, it was
always awkward to have to say "I did all these great things for this company, but you
can't contact them for a reference because the company is gone." It caused problems for me
for years.
I wish him and his company great luck. I don't know how many people
the company employs, but I seem to recall it's a small shop. Hopefully law enforcement has
been engaged, and they'll resolve it without the company suffering too greatly. I'm
convinced all these captors want is money; but in situations like these, they get no
money AND they ruin lives. Is that really acceptable collateral damage?