ransomware
Malware that locks or encrypts data, followed by a ransom demand for restored access.
Ransomware is a category of malicious software used for digital extortion attacks: the perpetrator infects an IT system, encrypts the victim's files or blocks access to the system, and then demands payment — typically in cryptocurrency — in exchange for the key or mechanism that restores access. In criminological and legal terms, a ransomware attack combines two types of conduct: unauthorised access to another party's IT systems and extortion. Danish police describe it as a form of hacking in which the computer is locked and payment is demanded to unlock it. The two elements always follow one another, and this gives the attack its particular character as a systematic, profit-driven crime.
Danish law contains no single statutory provision defining ransomware as an independent concept. Instead, the conduct is subsumed under existing provisions, in particular those concerning unauthorised access to other people's IT systems and extortion. Official guidance on IT security and crime treats ransomware as a concrete type of conduct rather than as a legally defined concept.
Ransomware attacks are today frequently carried out by organised criminal groups operating across borders. Groups such as Evil Corp — led by Maksim Yakubets — have been behind attacks using their own ransomware variants directed at financial institutions and critical infrastructure in several countries. The attacks are planned and executed as coordinated operations in which the development of the software, the infection of systems and the collection of the ransom form separate links in the chain.
The 2020 attack on the University Hospital in Düsseldorf illustrates the potential gravity of ransomware directed at critical infrastructure: the hospital's systems were paralysed, which directly affected patient treatment. The case raised legal and ethical questions about causation and criminal liability in situations where digital crime can have direct physical consequences for human life.
For organised criminal networks, ransomware functions as a tool for generating large sums of money with relatively low risk of physical exposure. Payments in cryptocurrency make tracing difficult, and attacks can be coordinated across national borders, which challenges traditional investigative and prosecutorial structures.
