Sabotage of Transportation Infrastructure

Transportation infrastructure, the backbone of our daily lives and economy, is increasingly facing a silent threat: cyber sabotage. It’s not just about data theft anymore; attackers are looking to disrupt, disable, and cause chaos. From the trains we ride to the systems managing air traffic, understanding how these critical networks can be targeted is the first step in protecting them. This article explores the various ways transportation infrastructure cyber sabotage can happen and what we can do about it.

Key Takeaways

Cyber sabotage of transportation infrastructure is a growing concern, with attackers aiming for disruption beyond simple data theft.
Common attack methods include phishing, exploiting web flaws, and denial-of-service attacks, often targeting human error or system weaknesses.
Advanced threats involve sophisticated techniques like AI-driven attacks, supply chain compromises, and attacks on low-level system firmware.
Insider threats and physical breaches, like tailgating or using infected USBs, pose significant risks that bypass traditional digital defenses.
Robust defense requires a layered approach, including strong identity management, network segmentation, secure development practices, and well-rehearsed incident response plans.

Understanding Transportation Infrastructure Cyber Sabotage

Transportation systems, from the roads we drive on to the air traffic control that keeps us safe, are increasingly reliant on digital technology. This reliance, while bringing efficiency, also opens the door to a new kind of threat: cyber sabotage. It’s not just about a hacker trying to steal credit card numbers anymore; we’re talking about deliberate actions designed to disrupt or disable critical services that keep our society moving. The motivations behind these attacks can be varied, ranging from geopolitical tensions and state-sponsored disruption to extremist groups looking to cause chaos, or even financially driven actors seeking to extort money.

The evolving threat landscape means that what was secure yesterday might not be today. Attackers are constantly finding new ways to exploit weaknesses. They might target the software that controls traffic lights, the systems managing railway switches, or the communication networks used by airlines. The goal is often to cause widespread disruption, impacting not just travel but also supply chains, emergency services, and the economy as a whole. It’s a serious issue that affects national security and public well-being.

Here are some key aspects to consider:

Motivations: Why would someone want to sabotage transportation systems? This can include political aims, like destabilizing a rival nation, or ideological reasons, such as protesting government policies. Financial gain is also a big driver, with ransomware attacks becoming more common.
Impact: What happens when these systems are attacked? We could see massive traffic jams, grounded flights, or disruptions to freight movement. This isn’t just an inconvenience; it can lead to economic losses, delays in essential goods, and even put lives at risk.
Attackers: Who is behind these attacks? They can be sophisticated state-sponsored groups with significant resources, organized criminal syndicates, or even lone individuals with malicious intent. The sophistication of the attacks varies widely.

The interconnected nature of modern transportation means a single point of failure, whether physical or digital, can have cascading effects across multiple modes of transport and even into other critical sectors. Understanding these vulnerabilities is the first step toward building more resilient systems.

It’s a complex problem, and the methods used are becoming more sophisticated. We’re seeing attacks that exploit everything from simple human error to highly technical vulnerabilities in software and hardware. The challenge is to stay ahead of these threats and protect the systems we all depend on. This requires a multi-layered approach, combining strong technical defenses with robust policies and continuous vigilance. Protecting these vital networks is a significant undertaking, and it’s something that requires ongoing attention from both public and private sectors. The potential for disruption is immense, making it a prime target for those looking to cause harm or gain an advantage. We need to be aware of the risks and actively work to mitigate them. The integrity of our transportation networks is paramount for national security and economic stability. Protecting critical infrastructure is a shared responsibility.

Common Attack Vectors Targeting Transportation Systems

When we talk about threats to transportation, it’s not just about physical damage anymore. Cyber attackers have found plenty of ways to mess with these systems, often by targeting the human element or exploiting weaknesses in the software we rely on. It’s a bit like finding a loose screw on a bike – seems small, but it can cause big problems.

Phishing and Social Engineering Tactics

This is a classic. Attackers try to trick people into giving up sensitive information, like login details or personal data. They might send fake emails that look like they’re from a trusted source, maybe a vendor or even a boss, asking you to click a link or open an attachment. This is often called phishing. It works because people are busy and sometimes don’t look closely enough. They might also use phone calls (vishing) or text messages (smishing) to do the same thing. The goal is usually to get credentials that can then be used to access more important systems.

Spear Phishing: Highly targeted emails aimed at specific individuals or groups.
Business Email Compromise (BEC): Impersonating executives or vendors to trick employees into making fraudulent payments or divulging information.
Urgency and Fear: Using tactics that pressure people into acting quickly without thinking.

Attackers often craft messages that play on common human emotions like urgency, fear, or even curiosity to bypass critical thinking and security protocols.

Exploiting Web Application Vulnerabilities

Transportation systems often have web-based interfaces for managing operations, booking, or customer service. These applications can have flaws, like coding errors or weak security settings, that attackers can exploit. Think of it like a poorly designed lock on a door. If there’s a known weakness, like SQL injection or cross-site scripting, attackers can use it to steal data, take control of parts of the system, or even disrupt services. Keeping these applications updated and properly configured is a big job.

SQL Injection: Inserting malicious code into database queries.
Cross-Site Scripting (XSS): Injecting malicious scripts into websites viewed by other users.
Insecure APIs: Weaknesses in the interfaces that allow different software components to communicate.

Denial of Service and Distributed Denial of Service Attacks

These attacks are all about overwhelming a system with so much traffic that it can’t function properly, or it crashes altogether. A simple Denial of Service (DoS) attack might come from one source, but a Distributed Denial of Service (DDoS) attack uses many compromised computers, often part of a botnet, to flood the target. Imagine a highway being completely blocked by thousands of cars all trying to get through at once. This can stop ticket systems, communication networks, or even control systems from working, causing major delays and chaos. DDoS mitigation tools are essential for defending against these kinds of disruptions.

Advanced Persistent Threats and Sophisticated Methodologies

Beyond the everyday nuisances, there’s a more serious level of threat we need to talk about: Advanced Persistent Threats, or APTs. These aren’t your typical smash-and-grab cyberattacks. APTs are like long-term, carefully planned operations, often carried out by well-funded groups, sometimes even nation-states. Their goal isn’t just to cause a quick disruption; it’s usually about stealthy espionage, stealing valuable intellectual property, or setting the stage for future, more significant attacks. They stick around, hence ‘persistent,’ and they’re incredibly hard to detect because they move slowly and deliberately.

AI-Driven Attacks and Automation

We’re seeing more and more attacks that use artificial intelligence and machine learning. Think of it as giving attackers a super-brain. AI can help them sift through massive amounts of data to find vulnerabilities much faster than a human could. It can also automate the process of creating highly convincing phishing emails or even generating fake voices and videos for social engineering scams. This means attacks can be launched at a much larger scale and with greater precision. It’s a game-changer for how threats are engineered.

Supply Chain and Dependency Exploitation

This is a really sneaky one. Instead of attacking a target directly, attackers go after a trusted supplier or a piece of software that the target uses. It’s like poisoning the well from which many people drink. They might compromise a software update, a hardware component, or even a third-party service provider. When the target then uses that compromised element, the attacker gains access. This can affect thousands of organizations at once because they all rely on the same trusted source. It’s a way to bypass direct defenses by exploiting trust relationships. Understanding these supply chain attacks is key for securing your digital ecosystem.

Firmware and Low-Level System Compromise

This is where things get really deep. Attackers are targeting the very foundation of our systems – the firmware. This is the software embedded in hardware components like your computer’s BIOS or the firmware in network devices. If an attacker can compromise this low-level code, they can essentially control the system from the ground up. The scary part is that firmware-level compromises can survive operating system reinstallation, making them incredibly persistent and difficult to remove. It requires specialized tools and techniques to even detect, let alone defend against.

APTs often employ a combination of these sophisticated methodologies. They might use AI to identify a weak link in a supply chain, then exploit firmware vulnerabilities to gain deep, persistent access. Their operations are characterized by patience, adaptability, and a focus on stealth, making them a significant challenge for even well-defended organizations.

Insider Threats and Malicious Code

Sometimes, the biggest threats don’t come from the outside. We’re talking about insider threats, where people already within an organization, like employees or contractors, cause harm. This can be intentional, like someone seeking revenge or financial gain, or it can be accidental, due to carelessness or lack of training. These actions can range from deleting critical data to deliberately slowing down systems.

Insider Sabotage and Malicious Intent

When an authorized individual deliberately acts against the organization’s interests, it’s a serious problem. This could involve an employee who feels wronged and decides to disrupt operations before leaving, or someone being bribed to provide access or information to external attackers. Because these individuals already have legitimate access, their actions can be harder to spot initially. Monitoring user activity and access patterns is key to detecting such malicious intent.

Logic Bombs and Backdoor Installations

Malicious code can be hidden within systems, waiting for a specific trigger. A logic bomb is a piece of code designed to activate under certain conditions – maybe a specific date, or when a particular event occurs. Think of it like a digital time bomb. Similarly, backdoors are secret ways into a system that bypass normal security checks. These can be installed by insiders or through external attacks, allowing persistent access even if vulnerabilities are patched later. They are often used to maintain a foothold for future operations.

Rootkits and Stealthy Operations

Once an insider has established a presence or planted malicious code, they often want to hide their tracks. This is where rootkits come in. These are sophisticated tools designed to conceal malicious processes, files, and network connections from detection. They can operate at a very low level within the system, making them incredibly difficult to find and remove. This stealth allows attackers to maintain access and conduct operations for extended periods without being noticed, significantly increasing the potential damage.

Here’s a look at how insider threats can manifest:

Data Theft: Stealing sensitive information for personal gain or to sell.
System Disruption: Intentionally causing downtime or performance issues.
Sabotage: Deleting or corrupting critical data and operational systems.
Credential Misuse: Using authorized access for unauthorized purposes or sharing credentials.

The challenge with insider threats is that the actions often appear legitimate on the surface. Standard security tools might not flag an employee accessing files they are authorized to see, even if their intent is malicious. This highlights the need for behavioral analytics and strict access controls, like the principle of least privilege, to limit the potential damage any single user can cause.

Physical Security Breaches and Human Factors

Beyond the digital realm, physical access and human behavior present significant vulnerabilities in transportation infrastructure security. It’s easy to get caught up in firewalls and encryption, but sometimes the simplest methods are the most effective for attackers. Think about it: if someone can just walk into a control room or plug a device into a server, all your complex cyber defenses might become irrelevant.

Tailgating and Unauthorized Access

This is a classic. Tailgating, or piggybacking, happens when an unauthorized person follows closely behind an authorized individual through a secure entry point. It bypasses electronic locks and badge readers entirely. It relies on politeness or distraction – someone holding a door open for a person they assume belongs there. This isn’t just about getting into a building; it could mean gaining access to sensitive areas like network closets or operations centers.

Key takeaway: Physical barriers are only as strong as the people enforcing them.

USB-Based Malware and Data Theft

Remember those USB drives everyone used to carry? They’re still a threat. A seemingly innocent USB stick dropped in a parking lot or left on a desk can be loaded with malware. Once plugged into a system, it can spread rapidly, steal data, or create a backdoor for later access. This is especially concerning for systems that might not be constantly connected to the internet, sometimes called air-gapped systems. Even a quick connection can be enough to compromise sensitive equipment.

QR Code Phishing and Deception

QR codes are everywhere now, from restaurant menus to public transport schedules. Attackers are exploiting this convenience. They can place malicious QR codes over legitimate ones, directing unsuspecting users to fake login pages or downloading malware onto their devices. This is a form of social engineering that leverages our trust in physical signage and the ease of scanning a code. A quick scan could lead to a compromised personal device, which might then have access to corporate networks or sensitive information.

The human element is often the weakest link. While technical safeguards are vital, they must be complemented by robust physical security protocols and continuous employee awareness training. Neglecting these aspects can undo even the most sophisticated digital defenses.

Cloud and IoT Vulnerabilities in Transportation

Transportation systems are increasingly relying on cloud services and a vast network of Internet of Things (IoT) devices. While this brings efficiency, it also opens up new avenues for attackers. Think about all the sensors on trains, traffic lights, and even the systems managing flight schedules – they’re all connected.

Cloud Misconfigurations and Account Compromise

Cloud environments, while powerful, can be tricky to secure. A common issue is misconfiguration. This means settings are left open or too permissive, like a storage bucket that anyone can access. Attackers can exploit these mistakes to steal data or even disrupt services. It’s like leaving your front door unlocked; it’s an easy way in. Securing cloud accounts with strong, unique passwords and multi-factor authentication is a basic but vital step.

Internet of Things Device Exploitation

IoT devices are everywhere in transportation, from smart sensors on roads to systems managing cargo. The problem is, many of these devices weren’t built with security as a top priority. They often have weak default passwords, lack regular updates, and have limited processing power for robust security measures. This makes them easy targets. An attacker could compromise a network of traffic sensors to cause gridlock or take over smart locks on shipping containers.

Here’s a quick look at some common IoT vulnerabilities:

Weak Authentication: Default or easily guessable passwords.
Lack of Updates: Devices are rarely patched, leaving known vulnerabilities open.
Insecure Communication: Data sent between devices might not be encrypted.
Limited Resources: Devices can’t always run advanced security software.

Shadow IT and Unmanaged Assets

Sometimes, departments or individuals within a transportation organization might adopt new cloud services or IoT devices without the IT or security team knowing. This is called ‘shadow IT’. These unmanaged assets create blind spots. Security teams can’t protect what they don’t know exists. If a rogue sensor or an unauthorized cloud storage account is compromised, it could provide a backdoor into the main network. It’s important to have clear policies and tools to discover and manage all connected assets, whether they’re officially sanctioned or not. This visibility is key to preventing unexpected breaches.

The interconnected nature of modern transportation means a vulnerability in one seemingly minor component, like a smart sensor or a cloud storage setting, can have cascading effects across the entire system. Proactive security planning and continuous monitoring are no longer optional; they are necessities for maintaining operational integrity and public safety.

Credential and Identity Exploitation Tactics

Credential Dumping and Reuse

Attackers often start by trying to get their hands on valid login credentials. This can happen in a few ways. They might try to dump credentials directly from a compromised system, pulling password hashes or even plain text passwords if they’re stored insecurely. A really common method is simply exploiting credential reuse. People tend to use the same password across multiple sites, so if one site gets breached, attackers can use those stolen credentials to try logging into other, potentially more sensitive, systems. This is a huge problem for transportation systems because a single compromised account could grant access to critical operational technology or passenger data. It’s like leaving a master key lying around.

Session Hijacking and Token Replay

Even if an attacker can’t get a password, they might be able to steal an active session. Think of a session like a temporary pass that lets you stay logged into a service without re-entering your password every few minutes. If an attacker can intercept or steal this session token, they can essentially impersonate you and gain access to your account and its privileges. Token replay is similar; it involves capturing a valid authentication token and then reusing it later to gain access. This bypasses the need for the actual password altogether.

Identity Federation and Access Management Weaknesses

Many modern systems use identity federation, where you can log in to one service using credentials from another (like using your Google account to log into a third-party app). While convenient, misconfigurations in these systems can create serious security gaps. If the federation setup isn’t secure, attackers could potentially compromise one identity provider and gain access to all the connected services. Similarly, weaknesses in how access is managed – like overly broad permissions or poor oversight of who has access to what – can make it easier for attackers to move around once they gain a foothold. It’s all about controlling who gets in and what they can do once they’re inside.

Weaknesses in how identities are managed and how credentials are protected are often the easiest way for attackers to get into systems. They don’t always need fancy exploits; sometimes, just using a stolen password or session token is enough to cause major disruption. Focusing on strong authentication and careful access control is key to stopping these kinds of attacks before they start.

Data Exfiltration and System Disruption

Modern attacks against transportation infrastructure are rarely limited to simple digital mischief. Often, the goal is clear—take valuable data, cause chaos, or both. Data exfiltration and targeted system disruption can paralyze transit, logistics, and public safety for days. Cybercriminals and other threat actors have learned how to combine subtle methods of data theft with more obvious and destructive attacks for maximum effect.

Covert Channel Data Exfiltration

Attackers don’t just rip data out through the front door. They use covert channels designed to blend in—sometimes for weeks or months. DNS tunneling, HTTPS encapsulation, and even slow, encrypted transfers at odd hours make exfiltration tough to spot. Sensitive files might leave the network for days before anyone catches on.

Common covert exfiltration techniques include:

DNS tunneling (hiding data within seemingly normal domain name requests)
Steganography (embedding files inside innocuous media)
Cloud storage abuse (using trusted apps to siphon information)

When monitoring normal network traffic, slow leaks are often missed—the difference between a disaster caught in time and one only realized after the damage is done.

Destructive Malware and Ransomware

Destructive malware, especially ransomware, has become one of the most disruptive threats. Once inside a system, these programs encrypt or even delete critical files, halting services and forcing organizations into a corner. Many recent ransomware incidents targeting transportation have also involved stealing data before locking it up—adding a blackmail aspect to the attack. You can find a deeper explanation of this evolution in double extortion tactics.

The impact of destructive code:

Operations are suspended indefinitely
Recovery requires specialized skills and resources
Public trust in transportation reliability suffers
Financial losses skyrocket from both downtime and ransom payments

Double and Triple Extortion Tactics

Attackers have grown more aggressive. Double extortion means not only encrypting an organization’s data but leaking stolen information if demands aren’t met. Triple extortion goes even further, threatening additional damage such as contacting customers or launching denial-of-service attacks unless payment is received.

Simple breakdown of these tactics and their key features:

Tactic	Actions by Attacker	Impact for Victim
Single Extortion	Encrypts data, demands ransom	Operational outage, lost files
Double Extortion	Encrypts + steals data, threatens leak	Privacy loss, blackmail
Triple Extortion	Above plus public shaming/DDoS threats	Escalating pressure, reputation

For organizations, refusing to pay doesn’t always mean the ordeal is over. Attackers may repeatedly extort victims or release sensitive files anyway.

Ultimately, the combination of stealthy data theft and dramatic public disruption has made modern cyber sabotage a nightmare for the transportation sector. Every organization needs to expect the possibility of covert exfiltration followed by public chaos if their defenses fall behind.

Defensive Strategies for Transportation Infrastructure

Protecting transportation systems from cyber sabotage requires a multi-layered approach, focusing on strong controls and proactive measures. It’s not just about firewalls anymore; it’s about building resilience into every part of the system.

Robust Identity and Access Governance

Controlling who can access what is pretty much the first line of defense. We need to make sure that only authorized people and systems can get into sensitive areas. This means using things like multi-factor authentication (MFA) everywhere possible. Think of it like needing a key and a special code to get into a secure room, not just one or the other. We also need to follow the principle of least privilege, meaning people only get access to the bare minimum they need to do their jobs. No one needs admin rights for everything, right? This limits the damage if an account gets compromised. Regularly reviewing who has access to what is also key, especially when people change roles or leave the organization.

Implement Multi-Factor Authentication (MFA): Require more than one form of verification for all access.
Enforce Least Privilege: Grant users only the permissions necessary for their roles.
Regular Access Reviews: Periodically audit and revoke unnecessary access.
Privileged Access Management (PAM): Tightly control and monitor accounts with elevated permissions.

Network Segmentation and Zero Trust Architectures

Instead of having one big, open network where a breach in one spot can spread everywhere, we need to break things down. Network segmentation means creating smaller, isolated zones. If one zone gets hit, the others are still safe. This is where the idea of a zero trust architecture really comes in handy. It basically means we don’t automatically trust anything or anyone, even if they’re already inside the network. Every access request, from any user or device, needs to be verified every single time. This is a big shift from older models where once you were inside, you were pretty much trusted.

The goal is to assume that threats exist both outside and inside the network perimeter. Verification is required from everyone and everything trying to access resources on the network.

Secure Development and Application Security

We can’t forget about the software itself. Applications and systems need to be built with security in mind from the very beginning, not as an afterthought. This involves things like secure coding practices, regular vulnerability testing, and threat modeling. If we find flaws early in the development process, it’s much cheaper and easier to fix them than after the system is already in use. This also applies to any third-party software or components we use. We need to know what’s in our software supply chain and make sure it’s not introducing hidden risks. Understanding supply chain attacks is vital here.

Here’s a quick look at what secure development entails:

Threat Modeling: Identifying potential threats early in the design phase.
Secure Coding Standards: Following guidelines to prevent common vulnerabilities.
Vulnerability Scanning and Penetration Testing: Regularly testing applications for weaknesses.
Dependency Management: Verifying the security of third-party libraries and components.
Input Validation: Ensuring all data entered into applications is handled safely.

Incident Response and Resilience Planning

When things go wrong, and they will, having a solid plan to deal with it is super important. It’s not just about stopping the bad guys; it’s about getting back to normal as quickly as possible. This means having clear steps for what to do when an incident happens, who does what, and how everyone communicates.

Developing Comprehensive Incident Response Plans

Think of incident response plans like a fire drill for your digital systems. You need to know exactly what to do when the alarm sounds. This involves creating detailed playbooks for different types of incidents, like ransomware attacks or data breaches. These playbooks should outline specific actions, roles, and responsibilities. It’s also a good idea to have a plan for how you’ll talk to people – your team, customers, and maybe even the media. Keeping everyone informed helps manage the situation and reduces panic.

Define clear roles and responsibilities: Who is in charge? Who makes decisions? Who handles communication?
Document procedures for common scenarios: What steps do you take for a phishing attack versus a system outage?
Establish communication channels: How will teams communicate internally and externally during an incident?
Include escalation paths: When does a situation need to be reported to higher management or external experts?

A well-defined incident response plan isn’t just a document; it’s a living guide that needs regular testing and updates. Without practice, even the best plan can fall apart under pressure.

Effective Containment and Isolation Procedures

Once an incident is detected, the immediate priority is to stop it from spreading. This is where containment and isolation come in. It’s like putting up barriers to prevent a fire from engulfing the whole building. For digital systems, this might mean disconnecting infected machines from the network, disabling compromised user accounts, or blocking suspicious network traffic. The goal is to limit the damage and prevent further compromise. This is where having a good understanding of your network architecture and how systems talk to each other really pays off. It helps you make smart decisions about what to isolate without causing unnecessary disruption to critical operations.

Post-Incident Review and Continuous Improvement

After the dust settles and systems are back online, the work isn’t over. A thorough post-incident review is absolutely vital. This is where you figure out what went wrong, why it happened, and how your response went. Did the plan work? Were there any gaps? What could have been done better? Analyzing these lessons learned helps you update your incident response plans, improve your security controls, and train your staff more effectively. It’s all about making sure you’re better prepared for the next time, because in the world of cybersecurity, there’s always a next time. This continuous cycle of review and improvement is what builds true resilience. It’s how organizations learn and adapt to the ever-changing threat landscape, making them stronger against future attacks. This process is key to building a robust cyber resilience strategy.

Looking Ahead

So, we’ve talked a lot about how transportation systems can be messed with, both online and in the real world. It’s not just about some hacker in a basement; it’s about everything from insider threats to physical break-ins and even just simple mistakes. Keeping things running smoothly means we all have to be a bit more aware, from the folks designing the systems to the people using them every day. It’s a constant effort to stay ahead of whatever new tricks bad actors come up with. Ultimately, making sure our roads, rails, and air travel are safe is a big job, and it’s going to take a lot of different approaches working together.

Frequently Asked Questions

What is transportation infrastructure cyber sabotage?

It’s like someone messing with the computer systems that run our trains, planes, and roads on purpose. They might try to stop things from working, steal information, or cause chaos, all by using computers and the internet.

Why would someone attack transportation systems?

People might attack these systems for different reasons. Some want to make money, others might be angry and want to cause trouble, or a country might try to hurt another country’s ability to move goods and people.

How do hackers get into these systems?

Hackers use tricky methods. They might send fake emails to trick workers into giving them passwords (that’s phishing). They could also find weak spots in websites or apps that control the transportation systems.

What’s the difference between a normal attack and an advanced one?

A normal attack might be like a quick smash-and-grab. An advanced attack, like an ‘Advanced Persistent Threat’ (APT), is more like a spy mission. Attackers hide for a long time, slowly learning about the system and waiting for the perfect moment to strike without being noticed.

Can people who work for the transportation company cause problems?

Yes, sometimes people who are supposed to have access to the systems can intentionally cause harm. This is called an ‘insider threat.’ They might delete important data or shut down systems because they are unhappy or paid to do so.

What are ‘logic bombs’ and ‘backdoors’?

A ‘logic bomb’ is like a hidden trap in a computer program that goes off when a certain condition is met, like a specific date. A ‘backdoor’ is a secret way into a system that lets hackers get in without going through the normal security steps.

How can physical security affect cyber safety?

If someone can physically get into a building or plug a bad USB drive into a computer, they can cause cyber problems. This is why securing doors, preventing people from bringing in unauthorized devices, and being careful about who enters restricted areas are all important.

What is ‘double extortion’ in ransomware attacks?

Imagine a robber breaks into your house, steals your valuables, and then locks you out. Double extortion is similar. Hackers first steal your important data, then they lock up your computer systems with ransomware. They then threaten to release your stolen data if you don’t pay them.