Problem: Read and answer the text below. Provide a feedback and ask challenging relevant questions regarding the text. Need Assignment Help?
The two ransomware incidents I examined occurred in Germany in 2026 and Atlanta in 2018. The first involved Die Linke, a major German political party, which confirmed that the Qilin ransomware group had stolen sensitive internal data, including personal information belonging to employees. Qilin is described as a financially and politically motivated Russian-speaking group, and in March 2026 they stole the sensitive data, demanding a ransom while threatening to leak the stolen information publicly. Die Linke notified German authorities and brought in external IT experts to contain the breach and restore affected systems.
The second incident occurred in 2018, when the City of Atlanta was hit by SamSam malware. Attackers infiltrated city systems and encrypted critical services, including police records, maintenance request systems, and parts of the judicial infrastructure. The attackers demanded a $50,000 ransom, but Atlanta presumably did not pay. Instead, the city undertook a lengthy and expensive recovery process that ultimately cost millions of dollars.
The most significant difference between these two incidents lies in the extortion strategy. In 2018, SamSam relied on traditional single-extortion tactics, using encryption to lock systems and coerce payment for decryption keys, seemingly to no avail for those hackers. By contrast, the 2026 Qilin attack focused on data theft and pressuring the victim to pay by threatening to leak the data. This reflects a broader evolution in ransomware: attackers have become more organized, more strategic, and increasingly focused on stealing sensitive information and using the threat of public exposure as leverage. Modern groups no longer need to disrupt infrastructure to cause harm - the mere threat of leaking private data is often enough to pressure victims into paying.