WannaCry Ransomware (2017): The Cyberattack That Sounded a Global Alarm

The WannaCry Ransomware Attack (2017): The Cyberattack That Sounded a Global Alarm

Eight years ago, on May 12, 2017, the world witnessed one of the most destructive events in the history of cyberattacks: the outbreak of WannaCry ransomware.

In just one day, the attack spread to more than 150 countries and infected hundreds of thousands of computers. Hospitals in the UK canceled surgeries, global companies were forced to shut down, and governments scrambled to contain the damage.

In Japan, too, major companies such as Nissan and Hitachi suffered costly operational shutdowns.

Eight years after the outbreak, WannaCry is still told as a defining case study in cybersecurity. It is the incident that drove home how vital system patching and ransomware preparedness are to surviving in the digital age.

We have covered the basics of ransomware in the following article.

What Is Ransomware? Infection Routes, Real Cases and Defenses Explained (2026)

What is WannaCry?

WannaCry is a type of malware known as a "ransomware worm," which both encrypts files and self-propagates to other vulnerable machines.

• Ransom demand: $300 worth of Bitcoin, doubling to $600 after three days.
• Threat: Files would be permanently deleted if payment was not made within seven days.
• Victim's screen: A red ransom note showing a Bitcoin address and a timer.

What made WannaCry so uniquely destructive was its ability to self-propagate. Unlike conventional ransomware that spreads through phishing emails, WannaCry could spread across an entire network without any human interaction at all.

How WannaCry spread

WannaCry used a powerful exploit called "EternalBlue" that targeted the SMB (Server Message Block) protocol in Microsoft Windows.

• EternalBlue was originally developed as a secret cyberweapon by the NSA (US National Security Agency).
• In April 2017, a hacker group calling itself "Shadow Brokers" leaked it online.
• Cybercriminals immediately integrated EternalBlue into WannaCry.

This gave WannaCry the ability to spread like a worm. Once it infected one computer, it scanned the network and automatically jumped to other computers.
There was a lineage of vulnerabilities that WannaCry exploited.

Scale of the infection

• Date of outbreak: May 12, 2017
• Countries affected: More than 150
• Machines infected: 300,000 to 400,000 worldwide

Major organizations affected worldwide

• UK National Health Service (NHS): Doctors lost access to patient records, ambulances were diverted, and more than 19,000 appointments were canceled.
• Telefónica, Spain: One of Europe's largest telecom companies was hit.
• FedEx (US): Delivery operations were seriously affected.
• Renault & Nissan: Several car plants were forced to halt production.
• Deutsche Bahn (Germany): Station displays and systems were compromised.

WannaCry's impact in Japan

Japan was no exception. Some of the country's largest companies took a heavy blow.

• Nissan Motor Co., Ltd.
  • Several Nissan plants in Japan, including the Tochigi plant, were temporarily forced to stop production.
  • The attack disrupted the supply chain and delayed vehicle manufacturing.
• Hitachi, Ltd.
  • Hitachi reported failures in its internal email and IT systems.
  • The ransomware disrupted operations and caused delays in manufacturing coordination and communication.
• Other organizations
  • Smaller logistics and service companies also reported IT system failures, but Japan's critical healthcare services were not as severely affected as the UK's NHS.

Economic damage in Japan

• Estimated at tens of millions of dollars (several billion yen), mainly from plant shutdowns and recovery work at Nissan and Hitachi.
• Japan's National center of Incident readiness and Strategy for Cybersecurity (NISC) issued an emergency alert, instructing companies to apply Microsoft's emergency patch.
• The incident triggered serious debate about the outdated Windows systems still in use across Japanese industry and government.

The ransom demand

Once infected, victims saw a ransom note on their screen with the following demands:

• $300 worth of Bitcoin for decryption
• Doubling to $600 if not paid within three days
• A threat that the data would be lost forever after seven days

How much ransom was actually collected

• The attackers received only about $140,000 (roughly 52 BTC at the time).
• Compared with damages worldwide running into billions of dollars, the ransom proceeds were tiny.

Most organizations chose not to pay, either because they had backups or because there was no guarantee that paying would get their files decrypted.

The "kill switch" that stopped WannaCry

The outbreak could have been far worse, but it was halted by chance.

• British researcher Marcus Hutchins (MalwareTech) discovered that, before running, WannaCry tried to reach a meaningless domain name.
• When he registered that domain for about $10, it unintentionally acted as a "kill switch" (an emergency stop).
• This dramatically slowed the spread of infection, although variants later emerged.

Without this discovery, millions more machines might have been infected.

Global economic damage

Although the ransom payments were small, the real cost came from downtime, lost productivity and recovery work.

• Total global damage: $4 billion to $8 billion
• UK NHS: £92 million in losses, including canceled treatments and system recovery.
• FedEx: Acknowledged a "material" financial impact.
• Renault & Nissan: Plants halted in Europe and Japan.
• Hitachi & Nissan (Japan): Tens of millions of dollars in lost revenue and recovery costs.

Who was behind WannaCry?

Governments of several countries later attributed the WannaCry attack to the North Korean state-sponsored hacking group "Lazarus Group."

• Countries making the attribution: The US, the UK, Japan and others.
• Possible motives:
  • Financial: Raising funds through Bitcoin ransoms.
  • Political: Demonstrating North Korea's cyber capabilities.

Recovery and response

Microsoft's role

• Microsoft had released a patch (MS17-010) two months before the attack.
• Many organizations had not applied it and remained vulnerable.
• After the outbreak, Microsoft took the unusual step of releasing an emergency patch even for Windows XP, which had officially reached end of support.

Victims' recovery

• Organizations with offline backups recovered relatively quickly.
• Victims without backups often lost their data permanently.
• Very few of those who paid the ransom succeeded in getting their files decrypted.

Lessons learned from WannaCry

• 1. Patch early, and patch often
  • Delayed updates were the single biggest reason WannaCry spread so widely.
• 2. Backups are a lifeline
  • Offline or cloud backups made rapid recovery possible.
• 3. Critical infrastructure is always at risk
  • Healthcare, transportation and manufacturing, the foundations of society, were all thrown into disruption.
• 1. State-developed tools can backfire
  • EternalBlue was a government-developed exploit. Once leaked, it became a weapon for the whole world.
• 1. Global cooperation is essential
  • Cybersecurity is a shared responsibility across countries and industries.

WannaCry's legacy in 2025

Eight years on, WannaCry remains deeply relevant today.

• Some unpatched Windows systems are still vulnerable.
• The attack accelerated the adoption of cyber insurance, incident response teams and SOCs (security operations centers).
• It prompted governments to rethink cyberweapons and the risks of stockpiling exploits.
• The "double extortion" tactic used by modern ransomware (stealing data before encrypting it) was inspired by the enormous impact WannaCry had.

Final thoughts

The 2017 WannaCry ransomware attack is remembered as a landmark event in the history of cybersecurity.

• It spread faster than any ransomware before it.
• It caused billions of dollars in damage worldwide, including at Nissan and Hitachi in Japan.
• It exposed the dangers of ignoring patches and relying on outdated systems.
• And it showed that one researcher's lucky discovery could stop a global cyber pandemic.

For organizations in 2025, the lesson of WannaCry is clear.

Don't wait until it's too late. Patch, back up and prepare for ransomware before the attack comes.

We have covered other types of ransomware in the following article.

Types of Ransomware (2026): A Complete List of 16 Major Strains, Classified by Attack Method