What is ransomware? Encryption for ransom, as it appears in filings and enforcement

Ransomware is malicious software that encrypts files and the systems that depend on them, making them unusable, so that attackers can demand a ransom, usually in cryptocurrency, in exchange for a decryption key. Attackers may also steal data first and threaten to publish it. For the victim it is an outage and can also be a reportable data breach.

How it shows up in filings

Some filers name it plainly. Data I/O's Item 1.05 report, signed on 21 August 2025, said it had experienced a ransomware incident on internal IT systems on 16 August 2025. It added that the expected costs were reasonably likely to have a material impact on its results. The record's Data I/O entry follows the case.

How regulators treat it

Health regulators treat encryption of patient data as a breach by default. The Department of Health and Human Services (HHS) says that when ransomware encrypts electronic protected health information, a breach has occurred, and notice follows unless the entity shows a low probability that the information was compromised.

Paying carries its own exposure. On 21 September 2021 the Treasury Department's Office of Foreign Assets Control (OFAC) warned that facilitating a payment to a sanctioned actor may violate its regulations. Civil penalties apply on a strict liability basis, and license applications for such payments face a presumption of denial. The advisory says the US government strongly discourages paying ransom or extortion demands.

Why it matters to a CISO

The Cybersecurity and Infrastructure Security Agency (CISA) notes that many variants try to find and delete or encrypt reachable backups, which is why it advises keeping backups offline. Whether restoration works shapes the materiality call, the HIPAA risk assessment and the cost line in any later filing.

What it is not

Ransomware is the tool, not the whole incident. Data theft with a threat to publish is double extortion when paired with encryption, and email payment fraud is business email compromise.

Where it appears on cisonews.net

Ransomware entries in the incident log include Sensata Technologies, Hanesbrands and Rackspace Technology, filed under different 8-K items before and after Item 1.05 existed. Related terms: Form 8-K Item 1.05, HIPAA Breach Notification Rule.