Three Days in May: The WannaCry Outbreak

It began on a Friday, because these things always seem to begin on a Friday. On the morning of May 12, 2017, doctors across England looked up from their screens to find them locked. In place of patient records stood a red window with a countdown clock and a demand: $300 in bitcoin, doubling to $600 in three days, files deleted forever in seven. By lunchtime, hospital staff were turning ambulances away and writing appointments on paper. By evening, the same red window had appeared on railway departure boards in Germany, factory floors in France, telecom offices in Spain, and government desks from Russia to Romania. In roughly four hours, a piece of ransomware called WannaCry had reached more than 150 countries.

The world learned a new word that weekend. For the security profession, though, the sharpest sting was not how novel WannaCry was — it was how preventable.

The stolen key

WannaCry did not spread through clever emails or unlucky clicks. It was a worm — self-propagating, no human required — and its engine was a weapon called EternalBlue: an exploit for a flaw in Windows file-sharing (SMBv1) developed by the United States' National Security Agency and kept secret for years. In April 2017, a group calling itself the Shadow Brokers dumped EternalBlue onto the open internet as part of a cache of stolen NSA tooling.

Here is the detail that still defines the story: Microsoft had shipped the fix two months earlier. The March 2017 patch, MS17-010, closed the hole on every supported version of Windows. The eight weeks between that patch and that Friday were the whole tragedy in miniature — a global inventory of machines that nobody had gotten around to updating, plus millions more running Windows XP, three years past its retirement, for which no fix existed at all. WannaCry didn't break through the world's defenses. It walked through a door the world had been told to close.

Four hours on a Friday

The numbers from that weekend remain startling. Over 200,000 machines infected across some 150 countries. In England, at least a third of NHS hospital trusts were disrupted along with nearly 600 GP practices; around 19,000 appointments were cancelled, five hospitals diverted emergency patients, and at least 139 urgent cancer referrals had to be rebooked. Telefónica told staff in Madrid to shut down their machines and go home. Renault paused production lines; Deutsche Bahn's station displays showed the ransom note between train times; FedEx, Nissan's Sunderland plant, and Russia's interior ministry all joined the casualty list.

India escaped the worst headlines but not the worm. Police systems in Andhra Pradesh were infected, companies across several states reported hits, CERT-In pushed out urgent advisories, and the Reserve Bank directed banks to patch their ATMs — a fleet then heavily dependent on Windows XP — before switching them back on. For many Indian IT teams, WannaCry was the first time a global cyber event arrived not as news from abroad but as a Monday-morning checklist.

The ten-dollar fix

The counterattack came not from a government or a security giant, but from a 22-year-old researcher in the south-west of England, working from his bedroom. Combing through WannaCry's code that Friday afternoon, Marcus Hutchins noticed the worm checking an odd, unregistered web address — a long string of gibberish — before each infection. On instinct, he registered the domain. It cost him $10.69.

The infections began to stop. The domain turned out to be a kill switch: as long as it answered, the worm stood down. Whether it was a deliberate abort mechanism or a clumsy anti-analysis trick remains debated, but the effect was not — one researcher's ten-dollar hunch froze the fastest-moving cyber outbreak the world had seen, buying defenders the weekend they desperately needed to patch. It stands, still, as perhaps the best return on a security investment ever recorded.

A shoddy weapon with a stolen engine

Strip away the weapons-grade exploit and WannaCry was, by criminal standards, amateur work. It carried a kill switch that a stranger could trip. Its payment system couldn't reliably tell who had paid, which meant paying rarely got files back — word of that spread quickly, and victims kept their money. On many older machines it simply crashed the system instead of encrypting it. When researchers finally tallied the three hardcoded bitcoin wallets, the world's most famous ransomware attack had collected barely $142,000, from just 383 payments — pocket change against the billions in damage it caused, and against the £92 million cost later estimated for the NHS alone.

That mismatch — catastrophic disruption, negligible profit — was the first public clue that WannaCry wasn't ordinary crime. It looked less like a business and more like a weapon test that had slipped its leash.

The reckoning

The weekend forced conversations that had been comfortably theoretical. Microsoft took the extraordinary step of shipping emergency patches for Windows XP and other retired systems — software it had every commercial right to leave dead. Its president, Brad Smith, then published a blunt essay arguing that governments stockpiling secret vulnerabilities had to answer for what happens when those stockpiles leak, likening the episode to the military having its missiles stolen. The debate over whether states should hoard flaws or help fix them has never really closed since.

For everyone running a network, the lessons were plainer. Know what you own. Patch like it matters, because the gap between "fix available" and "fix applied" is exactly where worms live. Kill legacy protocols before they kill you. And segment your network, because the difference between one infected PC and three hundred was, for most victims, nothing more than open internal doors.