2017 · Worm

WannaCry, 2017: the patch had been available for two months

Case file · 5 min read · Published 15 September 2026

People affected: No data stolen; more than 200,000 computers encrypted across around 150 countries
When it happened: 12 May 2017
Made public: 12 May 2017
How they got in: The EternalBlue exploit against Microsoft's SMBv1 file-sharing protocol, leaked publicly the previous month and patched by Microsoft in March 2017
Attributed to: Attributed by the UK and US governments to the Lazarus Group, associated with North Korea
What it cost: Estimated £92 million to the NHS in England alone; 80 of 236 trusts disrupted and over 19,000 appointments cancelled

What was exposed: Encrypted files across hospitals, manufacturers and logistics firms · Clinical service availability

On the afternoon of 12 May 2017, screens across English hospitals turned red. Appointments were cancelled, ambulances diverted, and staff went back to paper, not because anyone at those hospitals clicked anything, but because a machine somewhere on the network was reachable on port 445 and had not been patched since March.

What happened

In April 2017 a group calling itself the Shadow Brokers published a cache of exploits attributed to a US intelligence agency. Among them was EternalBlue, an exploit for a flaw in SMBv1, the old Microsoft protocol for file and printer sharing. Microsoft had issued the fix, MS17-010, in March, before the leak, which strongly suggests it had been told what was coming.

On 12 May, someone combined that exploit with ransomware. The result was a worm: on infecting a machine, WannaCry scanned for other reachable machines running unpatched SMBv1 and infected those too, without human involvement at any step. Within a day it had reached more than 200,000 computers in around 150 countries, Spanish telecoms, French car plants, German railway displays, Russian government systems, logistics companies, and the English NHS.

The NHS impact was the one that defined the event publicly. Eighty of 236 trusts were disrupted, more than 19,000 appointments and operations were cancelled, and some emergency departments diverted patients. No NHS organisation paid the ransom. The Department of Health later estimated the cost to the NHS in England at around £92 million, almost all of it disruption and recovery rather than payments.

Why hospitals, and why not simply patch

The reflexive explanation, that the NHS was running Windows XP and had not bothered to patch, is partly true, mostly wrong, and unhelpful in a way that matters, because it stops the conversation at "they should have tried harder".

The real obstacle is that a hospital is not an office. A CT scanner, an infusion pump or a laboratory analyser runs software certified as part of a regulated medical device. Applying an operating system update to it may formally invalidate that certification, and the manufacturer may not have tested it, some had gone out of business, and some devices were ten years into a fifteen-year service life. The clinician cannot take the scanner offline on a Tuesday because there are patients booked on it. None of that is negligence. It is a genuine conflict between two safety regimes, and the security one loses by default because its risk is hypothetical until the day it is not.

What actually determined who got hit. Not patch levels alone, network shape. WannaCry spread laterally, so the organisations that suffered most were those where one infected machine could reach thousands of others directly. Where networks were segmented, the worm hit a wall. Where medical devices sat on isolated VLANs with controlled routes, they survived being unpatchable. Segmentation is the control that makes an unpatchable device survivable, which is why it matters more in hospitals, factories and utilities than anywhere else.

The domain that stopped it

Hours into the outbreak, a researcher analysing the malware noticed it queried a long, unregistered domain name and halted if the domain resolved, most likely an anti-analysis check, on the reasoning that a sandbox tends to answer every DNS lookup. He registered the domain. New infections worldwide collapsed almost immediately.

It is a good story and it is routinely told with the wrong moral. It was not a defensive triumph; it was a flaw in the attacker's code, found by someone who happened to be looking at the right sample at the right moment, and it did nothing whatsoever for machines already encrypted. A defensive posture that depends on the adversary making a mistake is not a posture. The correct reading is that the world got a reprieve it had not earned, and had roughly six weeks to use it before NotPetya arrived in June using the same exploit with no kill switch and no intention of decrypting anything.

The timeline

14 March 2017: Microsoft publishes MS17-010, fixing the SMBv1 flaw.
14 April 2017: The Shadow Brokers publish the EternalBlue exploit publicly.
12 May 2017, morning: WannaCry begins spreading; European organisations report encryption within hours.
12 May 2017, afternoon: NHS trusts across England are disrupted; appointments and operations are cancelled.
12 May 2017, evening: A researcher registers the kill-switch domain; new infections drop sharply.
13 May 2017: Microsoft takes the unusual step of issuing patches for unsupported versions of Windows, including XP.
June 2017: NotPetya uses the same exploit with no kill switch, causing an order of magnitude more financial damage.
October 2017: The National Audit Office publishes its investigation; formal attribution to the Lazarus Group follows.

What it changed

WannaCry did more than any awareness campaign to establish that cyber incidents are a patient safety issue rather than an IT issue. In the UK it drove sustained investment in NHS infrastructure, a national programme to get off unsupported operating systems, and the creation of security operations capability that had not previously existed at that scale.

Technically, it ended SMBv1's long afterlife. The protocol was disabled by default in later Windows releases and ripped out of countless networks where it had survived purely because something old still needed it. It also normalised emergency out-of-band patching for unsupported systems, Microsoft's decision to ship a fix for Windows XP the day after the outbreak was extraordinary at the time and set an expectation that has recurred since.

The deepest change was to the argument about stockpiling vulnerabilities. EternalBlue was built on a flaw an intelligence agency had known about and kept, and the exploit's public release turned it into the engine of two global incidents within eight weeks. Whatever position one takes on the trade-off, this pair of incidents made the downside concrete: a retained exploit that leaks does not stay in the hands of professionals, and the bill is paid by hospitals.

What to take from it

For individuals, the ordinary advice covers this entirely: keep automatic updates on, and keep a backup that is not permanently connected to the machine it protects. The people who lost personal files to WannaCry were overwhelmingly those whose only copy was on the encrypted disk, or on a drive plugged into it.

For anyone responsible for a network containing equipment that cannot be patched, a clinic, a workshop, a small factory, the practical lesson is that patching is not the only lever and often not the available one. Put the unpatchable things where the rest of the network cannot reach them, take away their internet access if they do not need it, and test whether you could restore from backup while the systems are down rather than assuming you could. WannaCry was survivable. What determined survival was almost never how modern the machines were.

Questions people ask

How is a worm different from ordinary ransomware?

Ordinary ransomware needs a person to do something, open an attachment, run a file, follow a link. A worm does not. WannaCry carried an exploit for a network file-sharing protocol, so an infected machine could scan for and infect other reachable machines by itself. Nobody at the organisations hit had to make a mistake on the day. One vulnerable machine anywhere on a flat network was enough to take the network.

If Microsoft had already patched it, why did it spread?

Because patching a large estate is not one action. MS17-010 shipped in March 2017 and the outbreak was in May, and in between sat change control windows, machines that only patch when someone is logged in, systems whose vendors had not certified the update, and equipment nobody could take offline. The patch existed. Applying it everywhere was a programme of work, not a decision.

What was the kill switch?

The malware checked whether a particular unregistered domain resolved before encrypting, and stopped if it did, most likely a check for the kind of sandbox that answers every DNS query. A researcher analysing the sample registered the domain for a few dollars, which halted a large share of new infections worldwide within hours. It was a real and enormous intervention, and it was also luck, and it did nothing for machines already encrypted.

Did the NHS pay any ransoms?

The National Audit Office found no NHS organisation paid the ransom. The ransom was in any case a poor deal: the payment and decryption mechanism was crude, tracking who had paid was unreliable, and the operators collected a relatively trivial sum overall. The cost was almost entirely in disruption, cancelled care and recovery, not in payments.

Sources

UK National Audit Office, "Investigation: WannaCry cyber attack and the NHS", October 2017
Department of Health and Social Care, lessons learned review and cost estimate, 2018
Microsoft Security Bulletin MS17-010, March 2017
UK National Cyber Security Centre and US government attribution statements, late 2017