Quick answer: On 12 May 2017, the WannaCry ransomware spread automatically between Windows computers around the world using a vulnerability that Microsoft had already patched two months earlier. It encrypted files and demanded payment in Bitcoin. In the UK it disrupted at least 81 NHS trusts and forced thousands of appointments to be cancelled. The spread slowed when a researcher registered a “kill switch” domain, and the US and UK later attributed the attack to North Korea.
| Key facts | |
|---|---|
| Date | 12 May 2017 |
| Victims | Organizations worldwide, including the UK National Health Service |
| Type of attack | Self-spreading ransomware worm |
| Attacker | Attributed by the US and UK governments to North Korea |
| How it spread | A Windows SMB vulnerability (EternalBlue) that Microsoft patched in March 2017 |
| Impact | At least 81 NHS trusts disrupted; thousands of appointments and operations cancelled |
Timeline
- March 2017: Microsoft releases a patch for the Windows SMB vulnerability.
- 12 May 2017: WannaCry spreads globally within hours.
- 12 May 2017 (evening): Researcher Marcus Hutchins registers a domain that acts as a kill switch and slows the spread.
- October 2017: The UK National Audit Office publishes its investigation into the NHS impact.
- December 2017: The US and UK publicly attribute WannaCry to North Korea.
What happened
WannaCry was ransomware with a dangerous extra feature: it spread by itself. Using an exploit known as EternalBlue, it jumped from one Windows computer to another through file-sharing (SMB) connections, without anyone clicking anything. Any computer missing Microsoft’s March 2017 security update could be infected.
Within hours, it hit hospitals, factories, telecoms companies and government offices in many countries.
The impact on the NHS
The UK National Audit Office found that at least 81 of England’s NHS trusts were disrupted, along with hundreds of GP practices, and thousands of appointments and operations were cancelled. It concluded that basic IT security practices, such as patching and managing firewalls, could have prevented much of the damage.
The kill switch
On the day of the attack, security researcher Marcus Hutchins noticed the malware checked whether a particular web domain existed. He registered it, which caused new infections to stop spreading. The attack had already done enormous damage, but the discovery prevented much more.
Lessons for your organization
- Apply critical operating system patches quickly, especially for flaws that can spread automatically.
- Replace or isolate unsupported operating systems.
- Block unnecessary file-sharing (SMB) traffic at network boundaries.
- Segment networks so one infected device cannot reach everything.
- Keep offline backups and test restoring them.
This incident is part of our guide to major cyber attacks and data breaches, which compares the biggest incidents and the patterns behind them. Read about ransomware and network segmentation. To see whether the same weaknesses exist in your organization, take the free Cybersecurity Readiness Assessment.
Related reading
What Is a Worm in Cyber Security? How Computer Worms Spread
Frequently asked questions
What was WannaCry?
A ransomware worm that spread automatically between unpatched Windows computers worldwide on 12 May 2017.
How did WannaCry affect the NHS?
At least 81 NHS trusts were disrupted and thousands of appointments and operations were cancelled, according to the National Audit Office.
Who stopped WannaCry?
Researcher Marcus Hutchins slowed its spread by registering a kill switch domain found in the malware’s code.
