Resolution criteria

This market resolves to YES if, by 23:59 UTC on 9 April 2027, a single, distinct individual-directed malware, extortion, or ransomware campaign is publicly reported by a credible cybersecurity firm, government agency, official company disclosure, or major news outlet as having materially impacted more than 100,000 unique individuals, or if multiple credible expert sources converge on an estimate above that threshold.

For this market, “individual-directed” means the campaign was aimed at individuals themselves as the direct targets of the attack, rather than at a company, institution, or other organization whose customers, users, or account holders were only indirectly affected.

“Materially impacted” means the campaign directly caused one or more of the following for those individuals: compromise of their device or account, encryption or theft of their files or data, or a credible extortion or ransom threat backed by actual access, exfiltration, encryption, or comparable ability to inflict material harm. Mere contact, mere demands, or mere inclusion in a breached dataset does not count.

Background

This market is based on the prediction, argued in the post Do not be surprised if LessWrong gets hacked, that improving AI capabilities may soon make ransomware, malware and extortion campaigns much more scalable and dangerous.

The concern is that AI could let attackers run far more powerful malware, ransomware, and extortion campaigns against huge numbers of ordinary people, with greater automation, personalization, and ability to deny recovery than is typical today.

This market does not attempt to prove that any future campaign was caused by AI; it asks only whether that feared AI-driven shift becomes visible through a publicly reported individual-directed malware, extortion, or ransomware campaign materially impacting more than 100,000 people by 9 April 2027.