On May 12, 2017, a ransomware strain called WannaCry tore through hospitals, train stations, and corporate networks in more than 150 countries within a single day. It was not the most technically sophisticated cyberattack in history. It was something more dangerous: a demonstration of what happens when a stolen government weapon meets decades of unpatched infrastructure. Nine years later, that lesson still has not fully landed.

How WannaCry Spread Across the World in Hours

A Worm, Not a Trick

Most ransomware before WannaCry needed a human mistake to spread. A user had to click a malicious link or open an infected attachment to trigger the initial infection. WannaCry broke that pattern. It used a stolen NSA exploit called EternalBlue to move autonomously across networks through a Windows vulnerability, jumping from machine to machine with no human interaction required. A single unpatched device on a network was enough for the worm to reach every other vulnerable machine connected to it.

The Numbers Behind the Outbreak

By the time a security researcher activated an accidental kill switch, the ransomware had already infected more than 200,000 systems across 150 countries. Digital Shadows data put the toll at over 200,000 devices encrypted within just 24 hours on May 12, 2017. Symantec later estimated the total financial damage at approximately 4 billion dollars worldwide.

Key facts about the spread:

• Exploited a Windows vulnerability known as EternalBlue.
• Affected over 200,000 systems in 150 countries.
• Demanded a ransom of 300 to 600 dollars per machine.
• Stopped largely by accident, not by design.

The Accidental Hero

On May 12, 2017, security researcher Marcus Hutchins spotted an unusual domain embedded in WannaCry's code, registered it for a small fee, and unintentionally triggered a kill switch that slowed the outbreak before it could spread further. It was a stroke of luck, not a planned defense, and that distinction matters for understanding how close the world came to a far worse outcome.

Who Got Hit Hardest and Why

The NHS Became the Defining Image of the Crisis

Up to 70,000 devices across NHS hospitals in England and Scotland were affected, including computers, MRI scanners, blood-storage refrigerators, and operating theatre equipment. More than 600 NHS organizations were affected in total, including 34 hospital trusts directly infected and 46 others disrupted through preventative shutdowns or shared systems.

By May 12, some NHS services had to turn away non-critical emergencies, and several ambulances were diverted elsewhere. A peer-reviewed retrospective from Imperial College London quantified the operational damage. Hospital trusts directly infected experienced roughly 6 percent fewer total admissions per day during the WannaCry week compared to baseline, with 4 percent fewer emergency admissions and 9 percent fewer elective admissions.

Why the NHS was so exposed:

• Thousands of NHS computers were still running Windows XP, which Microsoft had stopped supporting years earlier.
• The network was large, heavily interconnected, and dependent on legacy systems.
• Patching cycles lagged far behind known vulnerabilities.

Despite the chaos, the human cost was contained. Clinical safety researchers later confirmed no patient deaths were directly tied to the attack, even as the disruption rippled through emergency and elective care.

Beyond Healthcare

Nissan's manufacturing plant in Tyne and Wear, England, halted production after the ransomware infected its systems, and Renault stopped production at several sites to contain the spread. The disruption was not confined to hospitals. It reached transit systems, universities, and manufacturers across continents within the same 24-hour window.

Who Was Behind the Attack and What It Exposed

Attribution Pointed to North Korea

Kaspersky Lab and Symantec found code similarities between WannaCry and malware previously linked to the Lazarus Group, which has been connected to North Korea and is believed responsible for the 2014 Sony Pictures hack and a 2016 Bangladesh bank heist. Microsoft president Brad Smith and the UK's National Cyber Security Centre both concluded North Korea was behind the attack, and the US government formally named North Korea as the main culprit in December 2017.

The Uncomfortable Question About the NSA

The deeper scandal was not who launched the attack but where the weapon came from. Edward Snowden argued that if the NSA had disclosed the flaw when they discovered it rather than after they lost control of it, the attack might never have happened. British cybersecurity expert Graham Cluley said there was clear culpability on the part of US intelligence services, arguing they could have fixed the underlying problem long before it was weaponized against hospitals.

This is the part of the WannaCry story that rarely makes it into the documentary cut. A number of experts have pointed to the practice of intelligence agencies stockpiling exploits for offensive use rather than disclosing them for defensive patching as a structural problem, not a one-off mistake.

The Legacy: Why WannaCry Still Matters in 2026

The Vulnerability Never Fully Disappeared

EternalBlue, the exploit at the heart of WannaCry, is still being used in attacks as recently as 2025, eight years after it first demonstrated what an autonomous worm could do to unpatched Windows systems. Threat intelligence from 2024 and early 2025 confirms the exploit continues to appear in targeted operations against legacy environments in healthcare and manufacturing.

The pressures that prevented timely patching in 2017, operational continuity requirements, budget limits, and the difficulty of updating systems that clinical workflows depend on, persist in those same sectors today.

The Threat Landscape Has Evolved, Not Disappeared

• Ransom payments dropped to 28 percent of incidents in 2025, as more attackers shift toward data theft and extortion without encryption.
• Ransomware-as-a-service groups continue to multiply, with smaller, faster-moving crews replacing the mega-syndicates of the past.
• In manufacturing alone, ransomware attacks caused over 18 billion dollars in losses in the first three quarters of 2026.
• In healthcare specifically, attacks bypassing native email defenses rose 47 percent in 2025, the same category of foundational security gap WannaCry exposed in 2017.

WannaCry did not change cybersecurity because it was clever. It changed cybersecurity because it showed, in the space of a single weekend, what happens when decades of deferred maintenance collide with a weapon built by a nation-state. That lesson, judging by 2026's breach reports, is still being relearned one organization at a time.