WannaCry: The May 2017 Ransomware That Hit Hospitals Worldwide

On Friday 12 May 2017, a ransomware program called WannaCry began spreading across the world. Within a day it had infected hundreds of thousands of computers in more than 150 countries, disrupting hospitals, factories, telecoms and transport. It spread using a Windows flaw for which Microsoft had released a fix two months earlier. For many, it was the moment that ransomware became front-page news.

How it worked

WannaCry combined two elements. The first was ransomware: it encrypted the files on the infected computer and displayed a message demanding a payment in bitcoin, initially 300 US dollars worth, rising to 600 if unpaid, in return for a decryption key. The second was a worm component that scanned for other computers it could reach and infected them without anyone clicking anything.

The worm used an exploit called EternalBlue, which targeted a weakness in the SMBv1 file-sharing protocol in Windows. The exploit was part of a set of tools thought to have been developed by the US National Security Agency, which was leaked online by a group calling itself the Shadow Brokers on 14 April 2017. Microsoft had issued a security update, MS17-010, on 14 March 2017, a month before the leak. Computers that had installed it were protected. Those that had not were vulnerable.

The NHS and other victims

The UK's National Health Service was among the best-known victims. A later report by the National Audit Office found that 81 of the 236 hospital trusts in England were affected: 34 were infected by the malware and the others were disrupted, for example because they shut systems down as a precaution. About 19,000 appointments were cancelled, and some ambulances were diverted. The NAO said that the NHS had been warned about the need to update, and that it had no evidence that patient data was compromised.

Other organisations affected included the Spanish telecommunications company Telefónica, the German railway operator Deutsche Bahn, the delivery firm FedEx and the car maker Renault. Later analysis found that most infected machines ran Windows 7 without the March update, though some older systems that no longer received regular updates were also affected. Microsoft took the unusual step of releasing a patch for unsupported systems such as Windows XP.

The kill switch

The outbreak was slowed by a lucky discovery. A British security researcher known as MalwareTech, Marcus Hutchins, found that the malware tried to contact a specific, unregistered web address before running its attack. He registered the domain for a few dollars, and as a result the malware, which treated a successful connection as a signal to stop, ceased to encrypt files on many new infections. The version that spread was quickly followed by variants without the same switch, but they were less widespread.

Who was behind it?

In December 2017 the US, UK and other governments publicly attributed WannaCry to North Korea, and in 2018 the US Department of Justice charged a North Korean programmer in connection with it. North Korea has denied involvement. Relatively little money was paid in ransom, which led analysts to note that the attack was poorly designed as a money-making scheme.

The pattern behind the damage

• Patches available, not installed. The fix existed for two months.
• Unsupported systems. Some machines were running software that no longer received updates.
• Old protocols left on. SMBv1 was an old feature that most organisations did not need.
• Weak backups. Where up-to-date offline backups existed, recovery was a matter of reinstalling.

Paying the ransom

Security agencies generally advise against paying ransoms, because payment does not guarantee that the files will be returned and it encourages more attacks. In the WannaCry case the question was largely academic: the payment process was clumsy, victims had to be matched to payments by hand, and many people who paid reported that they received nothing. The total collected was small compared with the disruption caused.

Later ransomware gangs learned from this and built better systems, with professional negotiation, stolen data held as a second form of pressure and payment portals that worked reliably. That evolution makes the earlier steps, prevention and good backups, even more important.

Think about the order of defence. First, prevent the infection by patching and restricting access. Second, limit the spread by separating systems. Third, make sure you can recover without paying, which means backups held somewhere the malware cannot reach and a practised restore procedure. If one layer fails, the next gives you room to act.

The practical lesson for site owners

Install security updates quickly, retire software that is no longer supported and turn off services you do not use. Keep backups that an infected computer cannot reach, because ransomware will happily encrypt a network drive that is always connected. Test a restore so you know that the backups actually work.

The same thinking applies to websites. Outdated plugins and old PHP versions are today's unpatched Windows machines. Our WordPress hosting and shared hosting plans use Plesk, and our knowledge base shows how to schedule backups. For wider advice see our security page.