Healthcare · United Kingdom · May 2017
NHS (WannaCry) Ransomware Attack
In May 2017, the WannaCry ransomware worm swept through unpatched systems worldwide and hit the UK's NHS especially hard, reportedly cancelling around 19,000 appointments and becoming a landmark healthcare ransomware event.
What happened
On May 12, 2017, a ransomware worm called WannaCry began spreading across the globe at a speed that stunned defenders. Within a day it had reached hundreds of thousands of computers in scores of countries. Among the most visibly affected organizations was the United Kingdom's National Health Service, where the attack disrupted hospitals and clinics across England and Scotland and became a defining moment in healthcare cybersecurity.
What made WannaCry so dangerous was that it did not need a human to click anything. It was a self-propagating worm that exploited a vulnerability in the Windows Server Message Block (SMB) protocol — the flaw known as EternalBlue. Any unpatched, internet-reachable Windows machine could be infected automatically, and from there the worm spread laterally to other vulnerable systems on the same network.
The NHS was hit hard not because it was singled out, but because parts of its large, complex estate ran older or unpatched Windows systems. A patch for the underlying vulnerability had been released weeks earlier, but in an organization the size of the NHS, applying updates everywhere quickly is a genuine operational challenge. The worm found the gaps.
The impact
The impact on the NHS was overwhelmingly operational rather than a data breach. Screens locked with ransom demands, and clinical systems became unavailable. Reporting and subsequent reviews indicated that around 19,000 appointments and operations were cancelled as a result, with a number of trusts diverting emergency patients to unaffected hospitals.
The human cost of that disruption is difficult to capture in a single number. Cancelled operations, delayed diagnoses, and diverted ambulances all carry real risk to patients even when no data is stolen. WannaCry made the point vividly: in healthcare, availability is a safety issue, not merely an IT inconvenience.
Financially, a later UK Department of Health assessment reportedly put the cost to the NHS at around £92 million, covering the disruption and the remediation and IT upgrades that followed. The ransom itself — roughly US$300 in Bitcoin per machine — was almost beside the point; little was reportedly paid, and the true cost was in lost operations and recovery.
How the attack unfolded
- Initial access: the worm scanned for internet-reachable Windows systems with the unpatched SMB vulnerability and infected them automatically — no phishing or user action required.
- Propagation: once on a network, WannaCry spread laterally to other vulnerable machines, multiplying rapidly.
- Encryption and impact: infected machines were encrypted and displayed a ransom demand, locking clinicians out of the systems they needed for care.
- The spread was ultimately slowed by the discovery of a 'kill switch' domain, but not before widespread disruption had occurred.
The recovery
Recovery involved isolating affected machines, applying the missing patches, and rebuilding or restoring systems — work that stretched across days and, in places, longer. The kill-switch discovery helped halt further spread, buying defenders time.
The longer-term response was strategic: the NHS and the UK government invested significantly in cyber resilience, patch management, and network segmentation, treating WannaCry as a wake-up call about the fragility of healthcare operations under attack.
How this attack could have been contained
WannaCry's defining trait was lateral, self-propagating spread — precisely what Immune's containment and microsegmentation are designed to stop. Automatic isolation of an affected host and segmentation of the network prevent a single infection from becoming an estate-wide outage.
Because the worm relied on network propagation, Immune's network monitoring and intrusion detection would have visibility into the abnormal SMB scanning and connection patterns that characterize this kind of spread, surfacing the event as it began rather than after mass encryption.
And where machines were encrypted, self-healing recovery from immutable backups is the difference between restoring in clinical order within a controlled window and cancelling 19,000 appointments while systems are rebuilt by hand.
Sources
Figures are drawn from public reporting and official disclosures and are presented as reported or estimated; they may be updated as further details become public.
Protect against attacks like this
How to defend against healthcare ransomware
Don't let an attack become a shutdown
See how Immune detects ransomware in seconds, contains it before it spreads, and self-heals clinical systems from immutable backups.