LIVE
TRACECHAIN™FORENSICS
FRAUD INTELLIGENCE · CASE FILES · GLOBAL SCOREBOARD
REPORT FRAUD Find your country and who to contact ▸🔍 Search cases, companies, countries, agencies
INTEL
PIG BUTCHERING: now the #1 loss category in the US by estimated volume / HUSHPUPPI: the Instagram that became the evidence -- Case 001 open / BEC: one spoofed email, one wire, seven figures -- see the methodology / ROSS ULBRICHT: full pardon January 21 2025 after 11+ years -- Case 013 open / ALL FIGURES LABELED: estimate vs conviction vs market collapse -- see Methodology / UNODC 2023: $5.4B estimated annually from SE Asia pig-butchering compounds [UNVERIFIED] / PIG BUTCHERING: now the #1 loss category in the US by estimated volume / HUSHPUPPI: the Instagram that became the evidence -- Case 001 open / BEC: one spoofed email, one wire, seven figures -- see the methodology / ROSS ULBRICHT: full pardon January 21 2025 after 11+ years -- Case 013 open / ALL FIGURES LABELED: estimate vs conviction vs market collapse -- see Methodology / UNODC 2023: $5.4B estimated annually from SE Asia pig-butchering compounds [UNVERIFIED]
◂ ALL COMPANIES◂ ALL CASES
COMPANY · GROUP/MALWARE

PC Cyborg Corporation (AIDS Trojan)

🇵🇦 Panama City, Panama (post-office box); disks mailed from London · FOUNDED 1989
THE FIGURE
$189
The demand per machine; there is no loss figure because the number who paid is unknown.
WHAT IT SAID IT WAS

The 'licensor' named on the ransom demand of the AIDS Information Introductory Diskette, with a post-office box in Panama.

WHAT IT REALLY WAS

A front name for the first ransomware: ~20,000 floppy disks mailed in December 1989 that scrambled file names after 90 reboots and demanded $189 (or $378) for a 'licence renewal'.

THE STORY

In December 1989 about 20,000 floppy disks labelled 'AIDS Information Introductory Diskette' were mailed from London to a medical mailing list. The software counted reboots and after 90 hid directories and scrambled file names, displaying a demand to send $189 to PC Cyborg Corporation at a Panama post-office box for a licence. Joseph Popp, a Harvard-trained biologist who had worked with the WHO, was arrested by the FBI on 1 February 1990 and extradited to Britain, where he was found unfit to stand trial in 1991. The 'corporation' never existed beyond the box.

WHO RAN IT
Joseph Popp ▸
author of the trojan; the 'corporation' was his front · open the case file
WHO WAS HURT
subscribers to a medical mailing list and WHO AIDS-conference delegates in ~90 countries
HOW IT ENDED
Founded
1989
Based
Panama City, Panama (post-office box); disks mailed from London
Ended
1990-02-01
How
collapsed — author arrested by the FBI 1 February 1990; extradited to Britain; ruled unfit to stand trial 1991

No company existed to penalise. Popp was charged with blackmail in Britain, found unfit for trial in November 1991 and returned to the US; he died in 2006. Nobody knows how many victims paid.

SOURCES
en.wikipedia.org/wiki/AIDS_(Trojan_horse)casefiles/CASE_061_JOSEPH_POPP_BRIEF.md
Facts as published in court records, regulator releases and the sources above. Anyone charged and not convicted is alleged only.
🏠 HOME📁 CASES🚨 WANTED🎮 PLAY🌍 WORLD