updates incident with ransom demand. Closes #2350