Risk register · entry
Q3 · EngineeredWannaCry ransomware attack
The fix shipped in March. In May the worm took 150 countries, on the machines nobody patched.
Tightly coupled systems where one small fault cascades and takes down the whole machine.
Why this room
WannaCry is placed in q3 because it was a self-propagating worm rather than a targeted intrusion: it used the EternalBlue SMBv1 exploit to move laterally without user action, so a single unpatched or unsupported machine inside a flat network was sufficient to take down an entire organisation's estate. The NHS case shows the coupling clearly, infection or precautionary shutdown at one point propagated into cancelled appointments and diverted emergency patients across unrelated organisations, and containment came not from any designed control but from an accidental kill-switch domain registered by an outside researcher on the first evening. The mechanism was cascade through tight coupling, which is the q3 signature.
The record
- Microsoft published security bulletin MS17-010, rated Critical, on 14 March 2017; WannaCry was released worldwide on 12 May 2017, 59 days later.certain
- WannaCry affected at least 80 of the 236 NHS trusts in England, either through infection or precautionary shutdown, plus 603 further primary care and other NHS organisations including 595 GP practices.certain
- NHS England identified 6,912 cancelled appointments and estimated that around 19,494 appointments were cancelled in total; five accident and emergency departments were unable to treat some patients and diverted them elsewhere.certain
- Before the attack NHS Digital had carried out on-site cyber-security assessments at 88 of the 236 trusts and none had passed; NHS Digital had issued critical alerts in March and April 2017 telling organisations to patch.certain
- The widely-quoted USD 4 billion total loss is an estimate by the private cyber-risk modelling firm Cyence; other assessments put losses in the hundreds of millions. Europol estimated around 200,000 computers infected across 150 countries.medium
Sources
The book
This entry is one of 111 in the register. The full story, and what it cost the people who lived it, is in Risky Business by Claudia Zeisberger, David Munro and Joanna Reijgersberg-Siew.
Join the waiting list