The 1989 AIDS Trojan is widely considered the first ransomware program, demanding payment to restore access to files.
Biologist Joseph Popp distributed the program on floppy disks labeled “AIDS Information” at an international AIDS conference. After a computer was rebooted 90 times, the Trojan hid directories and encrypted filenames, then displayed a ransom demand for a license from a Panamanian post-office box.
The program did not use modern cryptographic ransomware techniques: it changed filenames and stored information needed for recovery locally, allowing researchers to reverse its effects. Popp was arrested in 1990 but was judged unfit to stand trial.
The name “AIDS Trojan” refers to its disguise and subject matter, not to an actual connection with the AIDS virus. Modern ransomware usually encrypts file contents and often threatens data leaks, whereas the 1989 program mainly altered access to filenames.