Topic Library — Ransomware Attacks (Year 1 Foundations)

School: Minister Destiny Testimony Schools Track: Adult Class: Topic Library — Year 1 (Foundations) Founded and presented by: Minister Destiny Marie Morgan, Minister

This lesson is educational information, Massachusetts-first, and is not legal advice. Laws and procedures vary by state and by case. If you are in danger right now, call 911. If you have a real case, talk to a lawyer — legal aid organizations help many people for free.

Before you start

This school never asks your name. Your progress is saved to your student record, so you can pick up on any device. If you pass this unit's quiz (80% or higher, retakes allowed), you earn a downloadable certificate with a blank line — you write your own name on it after you save it. Quiz answers are not shown; if you miss a question, re-read the lesson and try again.
This unit teaches prevention and response only — what ransomware is, how it gets in, and what to do. It contains nothing about building or spreading malware. It deepens two things you already met: the Hackers unit described ransomware at alert level, and the Cyber Security Awareness unit taught backups as a habit. Here both become a full lesson, ending in a courtroom where a ransom payment met an insurance policy.

The lesson

Part 1. What ransomware is — encryption turned into extortion

Ransomware is malware — harmful software — that encrypts a victim's files: it transforms them, using a confidential process or key the attacker holds, into a form no one can read without that key. Photos, documents, business records, whole systems become sealed boxes in their owner's hands. The attacker then demands payment — the ransom — for the key that decrypts them. A ransom note, a message or screen the victim cannot miss, states the demand and usually a deadline designed to panic.

Hold the two halves apart, because everything in this unit follows from them. The first half is a locking crime: your own information is made unavailable to you. The second half is an extortion: the attacker sells you back your own access, under time pressure, with no enforceable promise. Modern operations often add a third element — copying the files before locking them, then threatening to publish them too. Authorities call that pattern double extortion, and it is why "we restored from backup" no longer ends every incident (Part 5).

Part 2. How it gets in — doors you have already learned to close

Ransomware rarely breaks down a wall. It walks through the doors this library has been teaching all along.

Phishing first. A fake message — the Cyber Security Awareness unit's anatomy: urgency, an almost-right sender, an unexpected attachment or link — delivers the malware or steals the password that lets the attacker in. Stolen and reused passwords, harvested from earlier breaches, are tried against remote access and email until one opens. Unpatched flaws are the third door: when a maker publishes a security update, attackers race to find systems whose owners have not applied it. Exposed remote access — a work computer reachable from the internet with a weak password and no second factor — completes the list.

Notice: every door on it has a named defense somewhere in this library. Ransomware is the bill that arrives when several of them were skipped at once.

Part 3. Prevention — updates, access discipline, and the backup that decides everything

Prevention has three layers, and you need all three because any one can fail.

Close the doors (Part 2). Automatic updates on, and the rest installed promptly. Unique passphrases or a password manager, two-factor authentication on email and remote access first, and the stop-and-verify procedure for every pressured message.

Limit the blast radius. Keep only the access each account and person needs — the need-to-know principle from the PII unit. A login that can reach only one folder cannot encrypt the whole cabinet.

Keep backups that survive the attack — the decisive layer. A backup only protects you if the ransomware cannot reach and encrypt it too. The plain-words version of the professional 3-2-1 idea: keep three copies of what matters, on two different kinds of storage, with one copy somewhere else — offline or in a separate service the infected machine cannot touch. An external drive that lives plugged into the computer is not that separate copy; it is a second victim in the same room. Set backups to run on their own, and verify them: a backup whose last successful run nobody has checked is a hope, not a backup. Test restoring one file now, while nothing is wrong.

Part 4. If it happens to you — the first moves, in order

Disconnect. Unplug the network cable or turn off Wi-Fi on the affected device, and disconnect connected drives, to slow the spread to other machines and to your backups. Do not keep working on the machine "to finish one thing."
Do not delete anything, and photograph the ransom note with another device if you can — the note, the file names, and the timing are evidence.
Report. File at ic3.gov, the FBI's Internet Crime Complaint Center, and tell your local police. For an organization, Part 5's fuller sequence applies — never the "support" that contacts it afterward, a second-wave trick the Hackers unit warns about.
Decide about payment with the official guidance in front of you. The FBI and CISA do not encourage paying a ransom: payment does not guarantee the files come back, copied data may be published anyway, and it funds the industry that will come back. This school teaches that guidance as the standing answer for individuals: do not pay; restore and report. Any organization facing the question belongs in the hands of its counsel, its insurer, and law enforcement — never in a panic at midnight.
Restore cleanly. Rebuild from your verified, separate backups after the entry door from Part 2 is found and closed — restoring onto a still-open door just schedules the sequel. Change passwords from a clean device, email first.

Part 5. When it hits an organization — response in outline, and the breach that travels with it

For a workplace, school, clinic, or town office, the outline is: contain (disconnect affected systems, protect the untouched backups), call (leadership, counsel, insurer, law enforcement), preserve (notes, logs, and machines untouched for investigators, the first-hour rule the Data Breaches unit teaches), and assess the theft half: because modern ransomware copies before it locks, an encryption event must be investigated as a possible data breach too, with the notification duties the Data Breaches unit outlines. Restoring service and answering the breach question are two tracks; finishing the first does not cancel the second.

One sentence for every employee in that room: the time to learn your organization's plan is this week, in the calm — who calls whom, where the backups live, who may speak to the attacker (answer: almost certainly not you). Improvised response is how the payment question gets decided by exhaustion at 2 a.m.

Part 6. The law around ransomware — crimes, and a ransom that met an insurance policy

Unauthorized access and extortion by computer are federal crimes under the Computer Fraud and Abuse Act, read below: the statute covers accessing protected computers without authorization and transmitting threats to damage a protected computer or obtain information from one, with intent to extort money or anything of value. Prosecution is the government's work; your report is how cases begin.

Civilly, the most instructive decided fight so far is not victim against attacker — attackers are hard to sue — but victim against insurer, over what a policy's words cover. In G&G Oil, read in full below, a company paid nearly $35,000 in bitcoin to unlock its encrypted servers, then claimed under its commercial crime policy's "computer fraud" provision. Two lower courts sided with the insurer; Indiana's highest court sent the case back, holding the loss could be read as resulting directly from the use of a computer while leaving the fraud question open. The lesson: coverage for this event is a question of the policy you actually hold, answered by reading it now — not a promise to argue about later.

Words to know — Ransomware Attacks

Ransomware — malware that encrypts a victim's files or systems and demands payment for the key that restores access.
Encryption — transforming data into a form that cannot be read without a confidential process or key.
Ransom note — the message an attacker leaves stating the demand, the deadline, and how to pay.
Double extortion — an attack that copies the victim's data before encrypting it, then threatens to publish the copy as second pressure.
Offline backup — a backup copy kept disconnected or separate enough that malware on the main system cannot reach it.
3-2-1 backup rule — keeping three copies of important data, on two different kinds of storage, with one copy somewhere else, offline or in a separate service.
Malware — harmful software designed to steal information, spy, damage, or seize control of a device. (Already in the library glossary via earlier units; kept here for this unit's completeness — see glossary fragment note.)
Phishing — a fake message impersonating a real institution or person to trick you into clicking or revealing information. (Already in the library glossary via earlier units; kept here for this unit's completeness — see glossary fragment note.)
Incident response — the organized steps for handling an attack: contain, preserve, report, restore. (Already in the library glossary via earlier units; kept here for this unit's completeness — see glossary fragment note.)

Myths vs facts — Ransomware Attacks

Myth: Paying the ransom is the reliable way to get everything back. Fact: The FBI and CISA do not encourage paying: payment guarantees nothing, copied data may be published anyway, and payment funds the industry. Backups are the recovery that works.
Myth: A backup plugged into the same computer protects me. Fact: Ransomware encrypts what it can reach. A connected backup is encrypted alongside the originals. One copy must live separate or offline.
Myth: Ransomware only targets big companies and hospitals. Fact: Selection is automated and opportunistic. A small office's files are worth as much per record, and its downtime pressure is greater.
Myth: If my files come back, the incident is over. Fact: Modern attacks copy before they lock. A restored system can still sit inside a data breach with its own duties.
Myth: Good antivirus makes updates and backups optional. Fact: Prevention is layered. Only a verified, separate backup survives the day every other layer fails.

Think it through — Ransomware Attacks

The situation: A three-person accounting office opens Monday to a screen on its file computer: files are encrypted, a note demands payment within 72 hours, and the office's backup drive — connected, as always — shows encrypted files too. The senior partner says, "We have payroll Friday. Just pay it quietly." A junior staffer who studied this unit is asked for her view.

Walk it through: (1) Name the event precisely (Part 1): ransomware with a connected — therefore also encrypted — backup; the 3-2-1 failure is why the payment question is on the table at all. (2) First moves before any payment talk (Part 4): disconnect the machine and the drive, photograph the note, delete nothing. (3) Answer "pay quietly" with Part 4's guidance: the FBI and CISA do not encourage paying — no guaranteed return, possible publication of copied data, funding for the next victim — and an organization's decision belongs with counsel, its insurer, and law enforcement, not with a deadline the attacker invented. (4) Open the second track (Part 5): client records were on that computer, so the office must investigate copying and face the Data Breaches unit's notification questions with its counsel. (5) Look past Friday: the rebuild ends with Part 3 done properly — updates, unique credentials with two-factor authentication, and 3-2-1 backups, verified — so this Monday never repeats.

Cases & codes to study — Ransomware Attacks

G&G Oil Co. of Indiana v. Continental Western Insurance Co., 165 N.E.3d 82 (Indiana Supreme Court, 2021)

The facts: A ransomware attacker encrypted an Indiana oil company's servers. After consulting the FBI, the company paid four bitcoins — nearly $35,000 — and regained access. Its commercial crime insurer refused to reimburse the payment under the policy's "computer fraud" provision, and the company sued.
The question: Did the company's loss "result directly from the use of a computer to fraudulently cause a transfer" of its money, within the meaning of that policy provision?
The ruling and the outcome: The Indiana Supreme Court held that the loss resulted directly from the use of a computer — the payment, though consciously made, was made under something close to duress and did not break the chain — but found that whether the attack was "fraudulent" under the policy could not be decided either way on the existing record. It reversed the judgment for the insurer, affirmed the denial of the company's own motion, and sent the case back. Neither side had won the coverage question outright.
Why it matters to you: Insurance for a ransomware event turns on the exact words of the policy actually held. Read your coverage now, in the calm (Part 6) — and let backups, not a future coverage argument, carry your plan.
📄 Court document: https://caseclips.courts.in.gov/2021/03/22/gg-oil-v-continental-western/ (the Indiana courts' official posting of the opinion summary and text)

The law itself — read the real words

18 U.S.C. § 1030 (U.S. Code) — the Computer Fraud and Abuse Act: federal crimes for accessing computers without authorization, including transmitting a threat to damage a protected computer or obtain information from one with intent to extort money or anything of value. Read it: https://www.govinfo.gov/content/pkg/USCODE-2024-title18/html/USCODE-2024-title18-partI-chap47-sec1030.htm
18 U.S.C. § 1028 (U.S. Code) — makes fraud involving identification documents, authentication features, and another person's means of identification a federal crime — often charged alongside the identity misuse a ransomware theft enables. Read it: https://uscode.house.gov/view.xhtml?req=Hologram&f=treesort&fq=true&num=0&hl=true&edition=prelim&granuleId=USC-prelim-title18-section1028

Where to read the real thing, free: CourtListener (https://www.courtlistener.com) for opinions; the U.S. Code at uscode.house.gov (https://uscode.house.gov); ransomware guidance at cisa.gov (https://www.cisa.gov).

Try this — Ransomware Attacks

☐ Verify your backups today: find the date of the last successful backup of your photos and documents.
☐ Set up the 3-2-1 pattern: three copies, two kinds of storage, one somewhere separate or offline.
☐ Test-restore one file from your separate copy, so the first restore of your life is not during an attack.
☐ Turn on automatic updates, and confirm two-factor authentication on email and any remote access.
☐ Write your first-hour card: disconnect, photograph the note, delete nothing, report at ic3.gov, do not pay.

Resources to keep — Ransomware Attacks

911 — if an attack involves threats to anyone's safety.
FBI Internet Crime Complaint Center — ic3.gov — report ransomware and internet crime.
Cybersecurity & Infrastructure Security Agency — cisa.gov — the joint #StopRansomware guidance.
Free Pathways Guide — this school's guide to turning free study into real credentials (in the Topic Library).
988 (call or text) — support any time an attack becomes a crisis.

What you earned / what's next — Ransomware Attacks

✅ Ransomware Attacks complete (quiz score 80% or higher): You can define ransomware as encryption plus extortion, name the doors it enters by, build prevention in three layers with a verified 3-2-1 backup at its center, run the first-hour response in order, state the FBI and CISA position on payment, and explain why a ransomware event must also be investigated as a possible breach.

Your certificate

Minister Destiny Testimony Schools Certificate of Completion — Ransomware Attacks

This certificate is presented by Minister Destiny Marie Morgan, Minister

Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)

Date completed: ______________

Congratulations. You know the one preparation an extortion cannot argue with: a copy the attacker cannot reach, tested before the day it is needed. — Minister Destiny Marie Morgan

This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or legal training for representing anyone.

What's next: Return to the Topic Library for your next Year 1 unit.

Sources

CS406: Information Security — Saylor Academy (https://learn.saylor.org/mod/page/view.php?id=29839) — open courseware checked for security principles, threats, and protective tools.
Foundations of Information Systems, Chapter 6 — OpenStax (https://openstax.org/books/foundations-information-systems/pages/6-summary) — open textbook checked for ransomware and risk concepts.
#StopRansomware guidance — Cybersecurity & Infrastructure Security Agency (cisa.gov) — the joint FBI/CISA position discouraging ransom payment and urging prompt reporting.
G&G Oil Co. of Indiana v. Continental Western Insurance Co., 165 N.E.3d 82 (Indiana Supreme Court 2021) — whether a ransom payment resulted directly from the use of a computer under a crime policy's computer fraud provision.
Title 18 § 1030 (U.S. Code) — the Computer Fraud and Abuse Act, including computer extortion.
Title 18 § 1028 (U.S. Code) — federal crimes involving identification documents and another person's means of identification.

Course Record — Ransomware Attacks

Learning outcomes: On completing this unit, the student can:

define ransomware as encryption used for extortion, including the double-extortion pattern;
list the entry doors ransomware uses and the defense that closes each;
build a 3-2-1 backup arrangement and explain why a connected backup does not count as the separate copy;
state the first-hour response steps in order, including disconnecting and preserving the ransom note;
state the FBI and CISA position on paying a ransom and the reasons behind it;
explain why an organization's ransomware event must also be investigated as a possible data breach;
summarize what the G&G Oil court decided and what it left open.

Study time: Approximately 1 hour — covering reading, activities, and the test. Students move at their own pace.
Assessment: A 10-question test drawn only from this unit's lesson. 80% or higher passes and earns the unit certificate. Answers are not shown; your score is saved to your student record, and retakes are allowed.
Level: Topic Library — Year 1 (Foundations) · Adult school · working rank on completion path: Freshman → Sophomore.
Version: Version 1.0 — October 2026.

Minister Destiny Testimony Schools — Adult. Educational information only, not legal advice. Help lines: 911 for emergencies · 988 Suicide & Crisis Lifeline (call/text 988).

Ready to test? This course's test is given at the Testing Center. Answers are never shown; score at least 80% to earn your certificate of completion. You may retake the test as many times as you need.