2017RansomwareWorm
WannaCry ransomware outbreak
12 May 2017
WannaCry spread worldwide in a single day by exploiting a Windows SMBv1 flaw that Microsoft had patched in March 2017 (MS17-010). It encrypted files and demanded Bitcoin. Its spread slowed after a researcher registered a domain that the malware checked, which acted as a kill switch.
- Victim
- Organisations worldwide, including the UK National Health Service
- Sector
- Healthcare and cross-sector
- Public attribution
- Publicly attributed by the US and UK governments to North Korea; the US Department of Justice charged a North Korean programmer in 2018.Lazarus Group profile
- Malware
- WannaCry
Impact
The UK National Audit Office found at least 81 of 236 NHS trusts in England were affected, along with 603 primary care and other NHS organisations, and NHS England estimated over 19,000 appointments would have been cancelled.
Root cause
Unpatched Windows systems with SMBv1 reachable, and weak network controls; NHS Digital told the NAO that action on internet-facing firewalls would have protected organisations.
Lessons learned: the controls it teaches
- Patch critical vulnerabilities quickly and track unsupported systems.
- Disable legacy protocols such as SMBv1 and block SMB at the perimeter.
- Have tested incident response and business continuity plans for clinical and critical services.