INCIDENT REPORT · CP-2017-001

WannaCry ransomware outbreak

L4 · CRITICALCONFIRMED

A self-spreading ransomware worm infected computers worldwide on 12 May 2017 until a kill switch halted it. Europol reported more than 200,000 victims in over 150 countries.

Incident ID: CP-2017-001
Incident date: 12 MAY 2017
Detection date: 12 MAY 2017
Affected countries: United Kingdom
Plotted location: London, United Kingdom (Most prominent affected organization (NHS England))
Threat classification: Level 4 — CRITICAL
Classification rationale: Global spread with significant disruption to an essential national health service.
Attack type: Ransomware
Nature: Malicious activity
Attack vector: Self-propagating worm exploiting the Windows SMBv1 vulnerability CVE-2017-0144 (EternalBlue), patched by Microsoft in March 2017
Sectors: Healthcare, Government, Telecommunications, Transportation, Manufacturing
Critical infrastructure: Yes
Organizations affected: NHS England (at least 81 of 236 trusts plus GP practices)
Operational consequences: The UK National Audit Office found at least 81 of 236 NHS trusts in England were affected. About 19,000 appointments were estimated to have been cancelled; 6,912 cancellations were recorded.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by the UK government (NCSC assessment) and the US White House (December 2017) to North Korean actors known as the Lazarus Group

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

WannaCry ransomware outbreak

L4 · CRITICALCONFIRMED

A self-spreading ransomware worm infected computers worldwide on 12 May 2017 until a kill switch halted it. Europol reported more than 200,000 victims in over 150 countries.

Incident ID

CP-2017-001

Incident date

12 MAY 2017

Detection date

12 MAY 2017

Affected countries

United Kingdom

Plotted location

London, United Kingdom (Most prominent affected organization (NHS England))

Threat classification

Level 4 — CRITICAL

Classification rationale

Global spread with significant disruption to an essential national health service.

Attack type

Ransomware

Nature

Malicious activity

Attack vector

Self-propagating worm exploiting the Windows SMBv1 vulnerability CVE-2017-0144 (EternalBlue), patched by Microsoft in March 2017

Sectors

Healthcare, Government, Telecommunications, Transportation, Manufacturing

Critical infrastructure

Yes

Organizations affected

NHS England (at least 81 of 236 trusts plus GP practices)

Operational consequences

The UK National Audit Office found at least 81 of 236 NHS trusts in England were affected. About 19,000 appointments were estimated to have been cancelled; 6,912 cancellations were recorded.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by the UK government (NCSC assessment) and the US White House (December 2017) to North Korean actors known as the Lazarus Group