The WannaCry Ransomware Attack That Shook 150 Countries

The WannaCry ransomware attack stands as one of the most devastating cyber incidents in history, paralyzing organizations and institutions across the globe in May 2017. In just a few days, over 300,000 computers across 150 countries were infected, triggering chaos in businesses, hospitals, and governments—showing firsthand the profound real-world consequences of cybercrime. 

The Origins of WannaCry 

WannaCry was a piece of ransomware—a type of malicious software that encrypts data on infected computers and demands ransom payments, typically in cryptocurrency, to unlock the files. What made this attack uniquely dangerous was its weapon: a Windows exploit known as “EternalBlue,” originally developed by the U.S. National Security Agency (NSA) to infiltrate systems. In an ironic twist, EternalBlue was leaked by the hacker group Shadow Brokers, turning an intelligence asset into an instrument of mass disruption. 

Microsoft had already issued security patches for the vulnerability, but countless organizations had failed to update their systems, leaving the door wide open for WannaCry to spread. The ransomware primarily struck machines running older, unpatched versions of Windows, which amplified its rapid propagation. 

How the Attack Unfolded 

The attack started on May 12, 2017, with its first wave emerging in Asia in the early morning hours. Within hours, major organizations such as FedEx, Nissan, Telefonica, Deutsche Bahn, and particularly the UK’s National Health Service (NHS), found themselves unable to access critical data. Ambulances were diverted, surgeries were canceled, and doctors’ access to patient records was blocked, highlighting how digital threats can physically endanger lives and public safety. 

WannaCry exploited the Server Message Block (SMB) protocol to “worm” its way through networks, with each compromised device seeking new victims automatically. The ransomware displayed a chilling message: pay around $300 in bitcoin within three days (or $600 within seven) or risk losing your files forever. The attack moved so quickly that it became almost impossible for IT teams to react before damage was done. 

Shutting Down the Chaos 

A major turning point occurred just hours after the outbreak began. Marcus Hutchins, an independent security researcher, accidentally discovered a “kill switch” embedded within the malware’s code. By registering a specific domain name mentioned in the code, Hutchins effectively disabled further spread of WannaCry. However, his success came too late for the hundreds of thousands already infected—many systems remained encrypted and unusable until the owners either paid the ransom or wiped their devices. 

The Impact and Lessons Learned 

WannaCry’s damage was vast, causing an estimated $4–8 billion in losses globally. The NHS alone suffered unprecedented disruption, with over a third of English hospital trusts affected and myriad routine and emergency services thrown into disarray. The suspected perpetrator, according to U.S. and U.K. intelligence, was North Korea—highlighting the blurred line between cybercrime and state-sponsored cyberwarfare. 

Perhaps the most lasting legacy of WannaCry is the urgent call-to-action it sent to the world. It demonstrated that old, unpatched systems—sometimes dismissed as harmless legacy tech—could become the weak point that brings down entire organizations. For businesses, governments, and individuals alike, the lesson is clear: cybersecurity basics matter. Regularly updating software, backing up data, and investing in the right defences aren’t optional—these steps are now essential for survival in our connected age. 

The chaos of WannaCry was a painful warning. For the future, it remains a powerful reminder that cyber hygiene is everyone’s responsibility.