WannaCry Ransomware Attack: On May 12, 2017, hospital staff across England started watching their computer screens lock up one by one. Patient records became inaccessible. CT scanners stopped working. Surgeries were cancelled. Ambulances were diverted to other hospitals.
Within hours, the same disaster was unfolding in Germany, Russia, Spain, China, and over 150 countries. By the end of that Friday, more than 230,000 computers were infected. The WannaCry ransomware attack had arrived — and the world was completely unprepared.
Related: Colonial Pipeline Ransomware Attack — How One Password Caused a National Emergency → https://cyberlytech.tech/category/cyber-case-studies
What Is the WannaCry Ransomware Attack?
WannaCry is a type of ransomware — malicious software that encrypts a victim’s files and demands payment for the decryption key. However, what made WannaCry uniquely dangerous was its self-spreading ability. It was not just ransomware. It was a cryptoworm, meaning it spread across networks automatically — without any human clicking a link or opening an email.
The secret weapon behind this capability was a hacking tool called EternalBlue. Importantly, EternalBlue was developed by the U.S. National Security Agency (NSA).
WannaCry Ransomware Attack: The NSA Connection
EternalBlue exploits a vulnerability in Microsoft’s Server Message Block (SMB) protocol. This is the system Windows uses to share files across networks. The NSA discovered this vulnerability and turned it into a weapon for their own intelligence operations.
In April 2017, a group called The Shadow Brokers leaked a collection of NSA hacking tools online — including EternalBlue. Microsoft had released a patch for the vulnerability one month earlier. However, millions of systems worldwide had not yet applied that patch.
As a result, WannaCry attackers incorporated EternalBlue into their ransomware. This gave it the ability to scan networks and automatically infect any unpatched Windows machine it could find.
Learn More: How Nation-State Hackers Operate → https://cyberlytech.tech/category/threat-intelligence
WannaCry Ransomware Attack: Global Impact in Numbers
The speed of the WannaCry ransomware attack was unprecedented. Here is a snapshot of the global damage:
- United Kingdom — NHS: 81 health trusts were affected. Approximately 19,000 appointments were cancelled. Five hospitals had to divert emergency patients.
- Russia: The Interior Ministry, telecom company MegaFon, and Russian Railways all reported infections.
- Spain: Telecom giant Telefonica was hit, along with several other major Spanish companies.
- Germany: Deutsche Bahn railway display boards showed the ransom message instead of train times.
- China: University networks and PetroChina gas station payment systems were disrupted.
- FedEx: The global shipping giant confirmed its systems were compromised.
Total estimated damage from the WannaCry ransomware attack reached between $4 billion and $8 billion globally.
The Accidental Hero Who Stopped the WannaCry Ransomware Attack
In one of the most remarkable stories in cybersecurity history, a 22-year-old British researcher named Marcus Hutchins accidentally discovered a kill switch that stopped WannaCry.
While analyzing the malware’s code, Hutchins noticed it checked whether a specific domain name was registered before running. He theorized this was a sandbox-evasion technique. So, on a hunch, he registered that domain for just $10.69.
The moment he registered it, every infected computer that could reach the internet called the domain — and since it now existed, WannaCry interpreted this as a signal to stop spreading. Consequently, new infections dropped dramatically within hours.
Marcus Hutchins had stopped one of the biggest cyberattacks in history with a ten-dollar domain purchase.
Who Was Behind the WannaCry Ransomware Attack?
In December 2017, the United States, United Kingdom, Australia, Canada, New Zealand, and Japan jointly attributed the WannaCry ransomware attack to North Korea — specifically to a hacking group known as Lazarus Group.
Interestingly, WannaCry generated only around $140,000 in ransom payments. This is tiny compared to the billions in damage it caused. As a result, analysts concluded the primary goal was disruption rather than financial gain.
Related: SolarWinds Attack — When Nation-State Hackers Target Critical Infrastructure
https://cyberlytech.tech/solarwinds-supply-chain-attack-case-study/
Why Were So Many Systems Unpatched Against WannaCry?
Microsoft had released the security patch six weeks before WannaCry struck. So why were hundreds of thousands of systems still vulnerable? Several factors explain this:
- Legacy systems: Many NHS hospitals ran Windows XP, which Microsoft had stopped updating in 2014. Upgrading these systems required significant resources.
- Slow patch cycles: Large organizations test patches extensively before deployment — a process that takes weeks or months.
- Connected medical devices: Equipment like CT scanners run embedded operating systems that cannot be updated without replacing the hardware.
- Lack of awareness: Many smaller organizations simply did not know the patch existed or understand its urgency.
WannaCry Ransomware Attack Lessons Every Organization Needs
1. Patch Management Is a Life-or-Death Issue
WannaCry exploited a vulnerability with a patch available for six weeks. Consequently, applying security patches quickly — especially critical ones — is one of the most impactful things any organization can do to reduce risk.
2. Legacy Systems Are a Ticking Time Bomb
Running end-of-life operating systems is extremely dangerous. Organizations that cannot upgrade immediately must isolate these systems from the main network and add additional monitoring.
3. Disable Unused Network Protocols
WannaCry spread via SMB protocol on port 445. Therefore, organizations should disable SMBv1 and block unused ports at the firewall — particularly for systems that do not need to share files.
4. Backups Are the Last Defense Against WannaCry-Style Attacks
Organizations with recent, tested, offline backups recovered from WannaCry without paying the ransom. The 3-2-1 backup rule — three copies, two different media types, one stored offline — remains the gold standard.
How to Protect Against WannaCry Ransomware Attacks Today
- Apply Windows security patches immediately — enable automatic updates where possible.
- Disable SMBv1 on all Windows systems — it is a legacy protocol most organizations no longer need.
- Block port 445 at the network perimeter for external traffic.
- Segment your network so ransomware cannot spread laterally across thousands of machines.
- Maintain regular, encrypted, offline backups and test restoration procedures regularly.
- Upgrade or isolate any end-of-life operating systems still in use.
The WannaCry ransomware attack was a digital wildfire that hit hospitals, corporations, and governments with equal force. It showed that neglecting the basics — patching, backups, network segmentation — is not just careless. As the NHS discovered that Friday morning in May 2017, it can be a matter of life and death.
Next: Deepfake $25M Fraud — The AI Attack That Fooled a Finance Team https://cyberlytech.tech/category/cyber-case-studies