Case Study: The WannaCry Ransomware Attack, Global (2017)

Organisation: Multiple organisations across 150 countries Sector: Healthcare, public sector, telecommunications, manufacturing and others | Region: Global | Year: 2017

What Happened

In May 2017, one of the most significant cyber attacks in history unfolded across 150 countries in a matter of hours. The WannaCry ransomware attack exploited a vulnerability in the Windows operating system known as EternalBlue, which had been developed by the US National Security Agency and was subsequently leaked by a hacking group known as the Shadow Brokers. Microsoft had released a patch for this vulnerability in March 2017, six weeks before the attack, but a vast number of organisations globally had not applied it.

WannaCry was a self-propagating ransomware worm: unlike traditional ransomware, which typically required a user to click a malicious link or open an infected attachment to spread, WannaCry could automatically scan networks for vulnerable systems and infect them without any human interaction. This allowed it to spread with extraordinary speed across both internal networks and the wider internet.

Within hours, the attack had infected hundreds of thousands of systems across hospitals, telecoms companies, manufacturing facilities, government agencies, banks and logistics companies around the world. In the United Kingdom, the National Health Service was one of the most severely affected organisations: 81 of 236 NHS trusts in England were affected, forcing the cancellation of tens of thousands of appointments and operations, the diversion of ambulances and the shutdown of emergency services in some areas.

The Scale and Cost

• Approximately 200,000 to 300,000 systems were infected across 150 countries
• The NHS in England alone is estimated to have incurred costs of approximately 92 million pounds from the attack, including the cost of cancelled appointments, the restoration of IT systems and the additional security measures implemented in the aftermath
• Global economic damage from WannaCry has been estimated at between four and eight billion US dollars, though precise figures are difficult to establish
• The attack was subsequently attributed by the governments of the United States, United Kingdom and Australia to the Lazarus Group, a cybercriminal organisation linked to North Korea
• A kill switch was accidentally discovered by a security researcher within hours of the attack beginning, which significantly slowed its spread, but the damage to already-infected systems was not reversed by the kill switch

Why It Could Have Been Prevented

The WannaCry attack is particularly instructive because it was, in principle, almost entirely preventable. Microsoft had released the patch that would have closed the EternalBlue vulnerability six weeks before the attack. Organisations that had applied that patch were not affected. The scale of the global damage was a direct reflection of the failure of a large number of organisations to implement a known, available fix for a known vulnerability.

Why did so many organisations fail to patch? The reasons are familiar and managerial in nature:

• Legacy systems: many NHS trusts were still running Windows XP, an operating system that Microsoft had ceased to support in 2014. Unsupported operating systems do not receive patches, meaning that even organisations that wanted to apply the fix for EternalBlue on their XP systems could not do so through normal channels. Running legacy systems is often an operational or budget decision, but it carries security consequences that must be understood and managed.
• Resource constraints: patching large, complex IT environments is time-consuming and can cause system downtime. In resource-constrained organisations, the operational disruption of applying patches is sometimes treated as a higher priority concern than the security risk of leaving vulnerabilities unaddressed.
• Absence of a formal patch management process: many of the affected organisations did not have a systematic process for tracking, prioritising and applying security patches. Without such a process, the responsibility for patching tends to fall through the gaps between different teams and individuals.
• Risk management failure: the vulnerability exploited by WannaCry was widely known in the security community before the attack. Organisations with effective threat intelligence processes and risk assessment frameworks had the information they needed to prioritise the patch before WannaCry was deployed. Many did not.

Lessons for Managers

• Patch management is a management responsibility as much as a technical one: the decision to delay patching because of operational disruption concerns, or to continue using unsupported legacy systems because replacement is expensive, is a risk management decision with security consequences. Managers should understand the security implications of these operational choices and ensure they are made consciously and transparently, with appropriate risk acceptance processes.
• Availability of a fix does not mean the fix has been applied: the existence of a security patch does not automatically protect an organisation. Managers should understand whether and how their team’s systems are kept up to date, and should feel empowered to ask their IT function about the status of critical security updates.
• The human element was absent, but the governance element was not: WannaCry required no human interaction to spread, which makes it unusual. However, the governance failures that left systems unpatched were entirely human in origin. Effective patch management requires clear ownership, defined processes and management oversight.
• Incident response planning determines outcome: NHS trusts that had tested incident response plans and clear escalation procedures were better able to manage the impact of the attack than those that did not. The quality of the response determined how long systems were down, how many patients were affected and how quickly normal operations were restored.
• Global threats affect local operations: WannaCry demonstrates that a vulnerability in software used globally, exploited by an attacker operating from a different continent, can disrupt the daily work of a hospital administrator in Manchester, a nurse in Singapore or a logistics manager in South Africa within hours. The global nature of cyber threats is not an abstraction: it is the operational reality for any organisation that uses connected technology.

Reflection Task

The WannaCry attack illustrates the gap between knowing a vulnerability exists and taking effective action to address it. Reflecting on your own organisation, consider: do you know how your organisation manages security patching? Is there a clear process, and does it include your team’s systems and devices? What would happen if a critical patch needed to be applied urgently across your team’s environment? Share your reflections in the discussion forum.