Article
Ransomware examples: attacks, types and groups
Ransomware examples explained: five documented attacks, the main types of ransomware and the groups named in recent government advisories.
Read more
Significant cyber incident
WannaCry ransomware attack on the NHS in England
On Friday 12 May 2017 the WannaCry ransomware, released worldwide, locked computers across the NHS in England.
In short
On Friday 12 May 2017 the WannaCry ransomware, released worldwide, locked computers across the NHS in England. The National Audit Office says at least 80 of 236 hospital trusts were affected, and 595 GP practices were infected. Thousands of appointments were canceled and five accident and emergency departments had to divert patients. It matters because the NAO found that all infected NHS organizations had unpatched or unsupported Windows systems, and the UK government later attributed WannaCry to the Lazarus Group.
What happened
On Friday 12 May 2017 the WannaCry ransomware was released worldwide. It encrypts data on infected computers and demands a ransom. The National Audit Office (NAO) calls it the largest cyber attack to affect the NHS in England. NHS England’s own review says the NHS was not a specific target.
The NAO says at least 80 of 236 hospital trusts were affected. Of these, 34 were infected and locked out of devices (25 were acute trusts) and 46 were not infected but had disruption, often after switching off systems as a precaution. A further 603 primary care and other organizations were infected, including 595 GP practices.
NHS England identified 6,912 canceled appointments and estimated more than 19,000 in total. Five accident and emergency departments diverted patients. A cyber-security researcher activated a kill-switch that evening, which stopped WannaCry locking more devices. NHS Digital believes no patient data were compromised or stolen.
Timeline
-
July 2016
Reviews by the National Data Guardian and the Care Quality Commission warn of the cyber attack risk to patient records.
-
October 2016
Northern Lincolnshire and Goole NHS Foundation Trust is hit by a ransomware attack, leading to 2,800 canceled appointments.
-
14 March 2017
Microsoft issues a patch for the vulnerability that WannaCry uses.
-
March and April 2017
NHS Digital issues critical alerts telling organizations to patch.
-
12 May 2017, late morning
The first trusts report problems.
-
12 May 2017, just after 13:00
NHS Digital's CareCERT alerts the Department of Health and Social Care after four trusts report ransomware.
-
12 May 2017, 16:00
NHS England declares a national major incident; 16 trusts have reported by this time.
-
12 May 2017, 16:55
NHS Digital releases a CareCERT bulletin with a technical description and advice.
-
12 May 2017, evening
A cyber-security researcher activates a kill-switch and WannaCry stops locking devices.
-
14 May 2017
NHS Digital writes to all trusts advising against paying ransoms.
-
15 May 2017
Staff work to prevent a new wave of infections on Monday.
-
16 May 2017
Only two hospitals are still diverting patients.
-
19 May 2017, 17:30
NHS England stands the incident down.
-
27 October 2017
The NAO publishes its investigation.
-
19 December 2017
The UK Foreign Office attributes WannaCry to the Lazarus Group.
-
1 February 2018
NHS England publishes the lessons learned review.
How the attack worked
Getting in
NHS England’s review says the initial infection was likely through an exposed, vulnerable, internet-facing Server Message Block (SMB) port, rather than email phishing as first assumed. NHS Digital told the NAO the ransomware spread via the internet, including the N3 network that connects NHS sites in England, and not via NHSmail. Microsoft had issued a patch for the vulnerability on 14 March 2017.
Spreading
MITRE ATT&CK says WannaCry uses an exploit in SMBv1 to spread to other remote systems on a network: Exploitation of Remote Services (T1210). It is a worm, so one unpatched machine could infect others without any user action. The sources opened do not describe the NHS spread in more technical detail.
Locking the data
WannaCry encrypts user files and demands a Bitcoin ransom: Data Encrypted for Impact (T1486). In the NHS, staff were locked out of devices and some medical equipment, such as scanners, was locked or isolated.
Why the NHS was exposed
The NAO says all infected NHS organizations had unpatched or unsupported Windows operating systems. NHS Digital told the NAO that most infected devices were unpatched but on supported Windows 7, and that managing internet-facing firewalls would have protected organizations whether or not they had patched.
- Exposed SMB portA vulnerable internet-facing SMB service on an unpatched Windows system is reachedTechnique T1210 (MITRE ATT&CK, opens in a new tab)
- Worm spreadWannaCry uses an SMBv1 exploit to move to other systems on the networkTechnique T1210 (MITRE ATT&CK, opens in a new tab)
- Files encryptedUser files are encrypted and a Bitcoin ransom is demandedTechnique T1486 (MITRE ATT&CK, opens in a new tab)
- Kill-switchA researcher activates a kill-switch on the evening of 12 May and locking stops
ATT&CK techniques
Who says who was behind it
Who attributed it, and how firm it is
Attributed by the UK Foreign Office, 19 December 2017: Lord Ahmad of Wimbledon attributed WannaCry to North Korean actors, the Lazarus Group. The statement says the UK National Cyber Security Centre assesses it is highly likely that the Lazarus Group were behind the campaign.
The NAO report (27 October 2017) and the NHS England review (1 February 2018) do not name an actor. NHS England's review says the NHS was not a specific target.
Sources differ on the NHS count: the Foreign Office says 48 NHS trusts were impacted, while the NAO says at least 80 of 236 trusts were affected (34 infected and locked out, 46 with disruption). The NAO counts organizations that reported disruption; the sources do not explain the lower figure.
Malware and vulnerabilities used
Impact
Trusts: at least 80 of 236 trusts in England were affected; 34 were infected and locked out of devices and 46 reported disruption without infection (NAO, 27 October 2017). A further 21 trusts were seen contacting the WannaCry domain without being locked out.
Primary care: 603 primary care and other organizations were infected, including 595 GP practices (NAO). NHS England's review puts this at 595 of 7,454 GP practices (8%) and eight other organizations, and says 1% of NHS activity was directly affected.
Patients: NHS England identified 6,912 canceled appointments and estimated more than 19,000 in total. Five accident and emergency departments diverted patients. By 16 May only two were still diverting. Neither the Department nor NHS England knows how many GP appointments were canceled or how many ambulances and patients were diverted.
Equipment: NHS England identified 1,220 infected pieces of diagnostic equipment by 19 May, 1% of all such equipment, not counting devices disconnected to prevent infection.
Data: NHS Digital believes no patient data were compromised or stolen.
Ransom and cost: no NHS organization paid the ransom, according to the Department, NHS England and the National Crime Agency. The Department does not know the cost of the disruption.
Global scale: the Foreign Office says 300,000 computers in 150 countries; NHS England's review cites Europol for more than 230,000 computers in at least 150 countries within a day. Sources differ on the global figure.
Government and regulator response
- 12 May 2017: NHS England declared a national major incident at 16:00 and took the lead on coordination at 18:45, with NHS Digital and NHS Improvement. NHS Digital published a technical bulletin at 16:55. A researcher’s kill-switch stopped further locking that evening (NAO; NHS England review).
- 13 to 15 May 2017: Staff worked over the weekend to prevent a new wave on Monday. NHS Digital wrote to all trusts on 14 May advising against paying ransoms (NAO).
- 19 May 2017: NHS England stood the incident down at 17:30 (NHS England review).
- After the attack: NHS England and NHS Improvement asked boards to confirm all 39 CareCERT alerts from March to May 2017 were implemented and local firewalls secured (NAO).
- 27 October 2017: The NAO published its investigation. It found the NHS had not rehearsed for a national cyber attack, so it was not immediately clear who should lead.
- 19 December 2017: The Foreign Office attributed WannaCry to the Lazarus Group.
- 1 February 2018: NHS England’s review reported a Cyber Handbook, 190 on-site assessments, GBP 21m reprioritized for major trauma centers and ambulance trusts, a further GBP 25m for 2017/18, an initial GBP 150m for 2018/19 to 2020/21, and a Microsoft agreement covering XP patches.
Lessons
-
Patch what is exposed
All infected NHS organizations had unpatched or unsupported Windows systems, and Microsoft's patch had been available since 14 March 2017.
-
Advice without a check is not control
NHS Digital issued critical alerts in March and April 2017, but the Department had no formal way to check whether organizations followed them, and NHS Digital cannot mandate action.
-
Firewalls are a second line
NHS Digital said managing internet-facing firewalls would have protected organizations whether or not they had patched.
-
Rehearse a cyber incident
The response plan had not been tested locally, it was unclear who should lead, and some trusts shut down systems as a precaution because central advice came late.
-
Plan for communications when email is down
Email was infected or switched off, so staff used phones and personal messaging. Have a fallback channel.
-
Leadership accountability
NHS England's review calls for Board-level accountability for cyber security in every health and care organization.
What to check in your own organization
-
Port 445 and SMB exposure
Confirm no SMB service is reachable from the internet and that SMBv1 is switched off where it is not needed.
-
Patch deadlines
Measure how fast critical operating system patches reach every device, including medical and diagnostic equipment.
-
Unsupported software
List every system on an unsupported operating system and agree a funded plan to replace it or isolate it.
-
Alert follow-up
When your security team or a national body issues a critical alert, confirm who checks that it was acted on, and how.
-
Segmentation of medical devices
Check whether scanners and lab equipment can be isolated from the main network without stopping care.
-
Offline procedures
Test paper-based and phone-based working for key clinical or business processes, and a way to talk when email is down.
-
Incident roles
Write down who leads a cyber incident, who declares it major, and rehearse it with local and national partners.
Where it happened
Questions
Was the NHS the target of WannaCry?
No. NHS England's review says the NHS was not a specific target. WannaCry was a global attack.
How many NHS organizations were affected?
The NAO says at least 80 of 236 trusts in England were affected (34 infected and locked out, 46 with disruption) and 595 GP practices were infected. The Foreign Office statement gives 48 NHS trusts. Sources differ.
Did the NHS pay the ransom?
No. The Department, NHS England and the National Crime Agency told the NAO that no NHS organization paid.
Was patient data stolen?
NHS Digital believes no patient data were compromised or stolen. NHS England's review reports no harm to patients or data compromised.
Who was behind WannaCry?
The UK Foreign Office attributed it to North Korean actors, the Lazarus Group, on 19 December 2017, citing an NCSC assessment of "highly likely".
How did it get into the NHS?
NHS England's review says the likely route was an exposed, vulnerable internet-facing SMB port, not email phishing.
How was it stopped?
A cyber-security researcher activated a kill-switch on the evening of 12 May 2017.
In our research
- Ransomware examples: attacks, types and groups October 2026
Sources
- Investigation: WannaCry cyber attack and the NHS (report page) National Audit Office
- Investigation: WannaCry cyber attack and the NHS (full report, 27 October 2017) National Audit Office
- Lessons learned review of the WannaCry Ransomware Cyber Attack (1 February 2018) NHS England
- Foreign Office Minister condemns North Korean actor for WannaCry attacks (19 December 2017) Foreign & Commonwealth Office, GOV.UK
- WannaCry, Software S0366 MITRE ATT&CK
- Indicators Associated With WannaCry Ransomware CISA
- Ransomware: 'WannaCry' guidance for enterprise administrators NCSC (UK)
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.