Topic Library — Ransomware Attacks (Year 1 Foundations)

School: Minister Destiny Testimony Schools Track: Law Enforcement Class: Topic Library — Year 1 (Foundations) Founded and presented by: Minister Destiny Marie Morgan, Minister

A note on what this school is: this is community-designed training — Minister Destiny's program, built from lived experience in the neighborhoods being policed. It is not agency policy and does not replace your department's training, general orders, or the law. Where this program proposes new approaches, they are taught and labeled as proposals. Nothing here is legal advice.

Before you start

• This school never collects your name. Progress and quiz answers stay on your device; pass the unit quiz (80% or higher, retakes allowed) and your certificate downloads with a blank name line to fill in after saving. Answers are not shown.
• Ransomware arrives in your working life three ways: as the victim's first phone call, as an attack on a public body in your jurisdiction — a school, a clinic, a town office — and as an attack on your own systems. This unit teaches the responder's outline only: what the crime is, how it enters, the posture agencies take before it happens, and your disciplined first moves. It teaches nothing about building or spreading malware, and nothing that substitutes for your department's process.

The lesson

Part 1. What ransomware is — the crime in two halves

Ransomware is malware that encrypts a victim's files and systems — transforms them, with a key the attacker holds, into a form no one can read without that key — and then demands payment for their return, announced in a ransom note with a deadline built to panic. The first half is a locking: the owner's own records become unavailable in the owner's own building. The second half is an extortion: access is sold back under time pressure, with no enforceable promise attached.

Modern operations add a third element your response must assume until investigation rules it out: copying before locking. Records are taken first, then encrypted, and the victim is threatened with publication as a second lever — double extortion. That fact changes the responder's whole posture: an encryption event is now also a possible data breach, carrying the notification duties the Data Breaches unit teaches, even if every system is later restored.

Part 2. How it gets in — the doors on your jurisdiction's buildings

Entry follows the patterns the Hackers unit maps, and your intake questions should hunt them in this order. Phishing delivers the malware or steals the password — a message with manufactured urgency, an almost-right sender, an unexpected attachment. Stolen or reused credentials, harvested from earlier breaches, are tried against email and remote access until one opens. Unpatched systems invite entry through flaws the maker has already published fixes for. Exposed remote access with weak or shared credentials and no second factor completes the usual list.

Why this matters to a responder who will never administer these systems: the entry door is evidence and prognosis at once. It tells investigators where to look, tells the victim what must close before anything is restored, and tells you whether nearby organizations sharing the same vendor should hear a warning through proper channels.

Part 3. Before the call — the posture that decides outcomes

Ransomware outcomes are mostly decided before the attack, by preparations no one applauds. Know what they are, because your questions and your advocacy inside your agency will run on them.

Backups that survive. The standard is the 3-2-1 pattern the Adult unit teaches: three copies of what matters, on two different kinds of storage, one copy somewhere separate — offline or in a service the infected system cannot reach — and verified by actual test restores. A backup drive that lives connected to its machine is encrypted in the same hour as the originals. Updates and access discipline. Automatic patching, unique credentials, two-factor authentication on email and remote access, and need-to-know limits on what any single account can reach. A written, rehearsed plan. Who is called first, who may speak for the organization, who decides — decided in a calm room, with counsel and insurer identified by name. The organizations that fare best are boring in exactly these ways, and the Data Breaches unit's first-hour preservation rule — stop, preserve, wait for qualified direction — is written into the good plans.

Part 4. The victim's first call — your moves, in order

1. Slow the room down. The deadline in the note is a weapon aimed at the victim's judgment. Your calm is the first countermeasure: nothing about a ransom note requires a decision in the next ten minutes.
2. Contain through the victim's own people. Affected systems disconnected from networks, connected drives unplugged, untouched backups left strictly alone — directed through the organization's own staff, under your department's process.
3. Preserve. Ransom notes photographed, not deleted; affected machines not wiped, re-imaged, or "cleaned" by a helpful volunteer; logs and messages kept. Cleanup is the most common destroyer of the evidence that establishes what happened.
4. Take the intake. What was noticed and when; what is encrypted and what still runs; whether copying is claimed or suspected; what information the systems hold — because Part 1's breach track runs on that answer; what has been touched since discovery; who has been told.
5. Route and report. Your chain and your department's investigative partners, and the federal channels: a report at ic3.gov and the FBI/CISA routes the guidance names. Tell the victim plainly what your process does next and what you will not promise — not recovery, not attribution, and not a payment recommendation. That last refusal is Part 5.

Part 5. The payment question — the official posture, stated plainly

Every ransomware victim arrives at the same question, usually within the hour: should we pay? Know the official answer so you never improvise one at a frightened person's worst moment. The FBI and CISA do not encourage paying a ransom: payment does not guarantee files will be recovered, it does not prevent copied data from being published, and it funds the same operations to strike the next organization. The agencies urge reporting promptly regardless of what a victim ultimately decides.

Your lane is the posture, not the decision. For any organization, the payment question belongs to its leadership, its counsel, and its insurer, with law-enforcement partners informed — professionals weighing legal exposure and operational reality no patrol-level conversation can carry. What you must never do is negotiate with an attacker, carry messages, or advise payment or refusal as if the choice were yours. And when a victim has already paid before calling, take the report with the same care, without a syllable of blame: shame reported late is how second victims are made.

Part 6. The law in outline — the federal crime, and a ransom in civil court

The Computer Fraud and Abuse Act, read below, makes the attacker's conduct federal crime in its core provisions: accessing protected computers without authorization, damaging them, and transmitting threats to damage a protected computer or obtain information from one, with intent to extort money or anything of value. Identification-document crimes under § 1028 often travel with the misuse of whatever the copying half stole. Charging and investigation belong to the government partners your routing reaches; your contribution is the preserved scene and the clean intake.

The decided case that teaches responders the most is, unexpectedly, an insurance fight. In G&G Oil, read below, a company that paid nearly $35,000 in bitcoin to unlock its servers sued its commercial crime insurer over the policy's "computer fraud" wording. Indiana's highest court held the loss could be read as resulting directly from the use of a computer, found the fraud question open, and sent the case back — no outright winner. Expect this pattern at real scenes: after the crime, a second dispute over who bears its cost, argued over policy language nobody read in the calm. It is one more reason your report's precision — what was encrypted, what was paid, when, and on whose instruction — outlives the incident.

Words to know — Ransomware Attacks

• Ransomware — malware that encrypts a victim's files or systems and demands payment for the key that restores access.
• Encryption — transforming data into a form that cannot be read without a confidential process or key.
• Ransom note — the message an attacker leaves stating the demand, the deadline, and how to pay.
• Double extortion — an attack that copies the victim's data before encrypting it, then threatens to publish the copy as a second pressure.
• Offline backup — a backup copy kept disconnected or separate enough that malware on the main system cannot reach and encrypt it.
• 3-2-1 backup rule — keeping three copies of important data, on two different kinds of storage, with one copy somewhere else, offline or in a separate service.
• Breach notification — the notice a holder must give to regulators and affected people after a breach, within the law's time and content rules.
• Need-to-know access — limiting records to people whose job duties require them.
• Incident response — the organized steps for handling an attack: contain, preserve, report, restore. (Already in the library glossary via earlier units; kept here for this unit's completeness — see glossary fragment note.)

Myths vs facts — Ransomware Attacks

• Myth: The ransom deadline means the victim must decide within hours. Fact: The deadline is a pressure device. Containment, preservation, and reporting come first; the payment question belongs to leadership, counsel, insurer, and law-enforcement partners.
• Myth: Paying quietly ends the incident. Fact: The FBI and CISA do not encourage paying: recovery is not guaranteed, copied data may be published anyway, payment funds the next attack — and the breach-notification track runs regardless.
• Myth: If systems are restored, there was no breach. Fact: Modern ransomware copies before it locks. Restoration answers the availability problem; the question of what was taken is separate and must be investigated.
• Myth: A connected backup drive is the victim's safety net. Fact: Ransomware encrypts what it can reach. Only a separate or offline copy — verified by test restores — survives the same hour.
• Myth: An officer on scene can help by negotiating or advising on payment. Fact: Negotiation and payment advice are outside the responder's lane. Your contribution is containment discipline, preservation, intake, and routing.

Think it through — Ransomware Attacks

The situation: You are first on scene at a town's water-department office at 7:40 a.m. The billing and customer systems are encrypted; a note demands payment within three days and claims customer records were copied. The office manager has already restarted two computers "to see if it helped," a council member is urging immediate payment "before the town can't bill anyone," and the IT contractor is an hour away. Walk your first thirty minutes.

Walk it through: (1) Slow the room (Part 4, step 1): name the deadline as pressure, not instruction, and state that no payment decision will be made in this room this morning — that question has owners (Part 5): leadership, counsel, insurer, and law-enforcement partners, with the FBI/CISA posture — payment not encouraged, reporting urged regardless — stated plainly. (2) Contain and preserve (Part 4, steps 2–3): affected systems disconnected through the office's own staff, remaining machines and backups left untouched pending the contractor and your department's process; the restarts already done are documented factually — what, when, by whom — without blame, because investigators need the record, not a culprit. (3) Take the intake (Part 4, step 4): discovery facts; what still runs; whether copying is claimed — it is, in the note — and therefore what residents' information the systems hold, opening Part 1's breach track and the Data Breaches unit's notification frame for the town's counsel. (4) Route (Part 4, step 5): your chain and investigative partners now, the ic3.gov report started, and the manager told plainly what happens next.

Cases & codes to study — Ransomware Attacks

G&G Oil Co. of Indiana v. Continental Western Insurance Co., 165 N.E.3d 82 (Indiana Supreme Court, 2021)

• The facts: A ransomware attacker encrypted an Indiana oil company's servers. After consulting the FBI, the company paid four bitcoins — nearly $35,000 — and regained access. Its commercial crime insurer refused to reimburse the payment under the policy's "computer fraud" provision, and the company sued.
• The question: Did the company's loss "result directly from the use of a computer to fraudulently cause a transfer" of its money, within the meaning of that policy provision?
• The ruling and the outcome: The Indiana Supreme Court held that the loss resulted directly from the use of a computer — the payment, though consciously made, was made under something close to duress and did not break the chain — but found that whether the attack was "fraudulent" under the policy could not be decided either way on the existing record. It reversed the judgment for the insurer, affirmed the denial of the company's own motion, and sent the case back. Neither side had won the coverage question outright.
• Why it matters to you: Your report becomes an exhibit in the second dispute — the one over who bears the cost. Precision about what was encrypted, what was paid, and on whose instruction is a responder's lasting contribution (Part 6).
• 📄 Court document: https://caseclips.courts.in.gov/2021/03/22/gg-oil-v-continental-western/ (the Indiana courts' official posting of the opinion summary and text)

The law itself — read the real words

• 18 U.S.C. § 1030 (U.S. Code) — the Computer Fraud and Abuse Act: federal crimes for accessing computers without authorization, including transmitting a threat to damage a protected computer or obtain information from one with intent to extort money or anything of value. Read it: https://www.govinfo.gov/content/pkg/USCODE-2024-title18/html/USCODE-2024-title18-partI-chap47-sec1030.htm
• 18 U.S.C. § 1028 (U.S. Code) — makes fraud involving identification documents, authentication features, and another person's means of identification a federal crime — often charged alongside the identity misuse a ransomware theft enables. Read it: https://uscode.house.gov/view.xhtml?req=Hologram&f=treesort&fq=true&num=0&hl=true&edition=prelim&granuleId=USC-prelim-title18-section1028

Where to read the real thing, free: CourtListener (https://www.courtlistener.com) for opinions; the U.S. Code at uscode.house.gov (https://uscode.house.gov); ransomware guidance at cisa.gov (https://www.cisa.gov).

Try this — Ransomware Attacks

• ☐ Memorize the responder's order: slow the room, contain, preserve, intake, route.
• ☐ State the FBI/CISA payment posture and its three reasons from memory — without advising any victim yourself.
• ☐ Learn your department's routing for a ransomware call: chain, partners, and the federal reporting channels, before a live call.
• ☐ Audit your own household by Part 3's standard: 3-2-1 backups, verified — then ask the same question, through proper channels, about your station's public-facing systems.
• ☐ Practice the sentence you will not cross: what you will not promise a victim in the first hour.

Resources to keep — Ransomware Attacks

• 911 — for immediate danger to any person.
• FBI Internet Crime Complaint Center — ic3.gov — report ransomware and internet crime.
• Cybersecurity & Infrastructure Security Agency — cisa.gov — the joint #StopRansomware guidance.
• mass.gov — official Massachusetts information and reporting channels.
• Free Pathways Guide — this school's guide to turning free study into real credentials (in the Topic Library).
• 988 (call or text) — support any time an incident becomes a crisis.

What you earned / what's next — Ransomware Attacks

✅ Ransomware Attacks complete (quiz score 80% or higher): You can define ransomware in its locking, extortion, and copying halves, name its entry doors, state the preparations that decide outcomes, run the first-call sequence in order, give the official payment posture without leaving your lane, and explain the federal crime and the civil fight that follows.

Your certificate

Minister Destiny Testimony Schools Certificate of Completion — Ransomware Attacks

This certificate is presented by Minister Destiny Marie Morgan, Minister

Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)

Date completed: ______________

Congratulations. When the note is on the screen and the room is frightened, your calm, your questions, and your untouched evidence are the response. — Minister Destiny Marie Morgan

This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or legal training for representing anyone. School rank and completion are school achievements only — not a law-enforcement rank, title, or credential.

What's next: Return to the Topic Library for your next Year 1 unit.

Sources

• CS406: Information Security — Saylor Academy (https://learn.saylor.org/mod/page/view.php?id=29839) — open courseware checked for security principles, threats, and protective tools.
• Foundations of Information Systems, Chapter 6 — OpenStax (https://openstax.org/books/foundations-information-systems/pages/6-summary) — open textbook checked for ransomware and risk concepts.
• #StopRansomware guidance — Cybersecurity & Infrastructure Security Agency (cisa.gov) — the joint FBI/CISA position discouraging ransom payment and urging prompt reporting.
• G&G Oil Co. of Indiana v. Continental Western Insurance Co., 165 N.E.3d 82 (Indiana Supreme Court 2021) — whether a ransom payment resulted directly from the use of a computer under a crime policy's computer fraud provision.
• Title 18 § 1030 (U.S. Code) — the Computer Fraud and Abuse Act, including computer extortion.
• Title 18 § 1028 (U.S. Code) — federal crimes involving identification documents and another person's means of identification.

Course Record — Ransomware Attacks

• Learning outcomes: On completing this unit, the student can:
• define ransomware in its locking, extortion, and copying elements;
• list the entry doors ransomware uses and state the intake questions that hunt them;
• describe the preparations — verified separate backups, updates, access discipline, and a rehearsed plan — that decide outcomes;
• conduct a victim's first call in order: slow the room, contain, preserve, intake, route;
• state the FBI and CISA position on paying a ransom and explain the responder's lane on that question;
• explain why an encryption event must also be treated as a possible data breach.
• Study time: Approximately 1 hour — covering reading, activities, and the test. Students move at their own pace.
• Assessment: A 10-question test drawn only from this unit's lesson. 80% or higher passes and earns the unit certificate. Answers are not shown; your score is saved to your student record, and retakes are allowed.
• Level: Topic Library — Year 1 (Foundations) · Law Enforcement school · working rank on completion path: Freshman → Sophomore.
• Version: Version 1.0 — October 2026.

Minister Destiny Testimony Schools — Law Enforcement. Educational information only, not legal advice. Help lines: 911 for emergencies · 988 Suicide & Crisis Lifeline (call/text 988).