Secordit home
Contact

What was WannaCry?

WannaCry is ransomware that spread worldwide on Friday 12 May 2017. It encrypted data on infected computers and demanded a payment to restore access. The National Audit Office records that it was the largest cyber attack to affect the NHS in England. Paying a ransom does not mean you will get access to your data or computer. 12

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. The ransomware was released worldwide on Friday 12 May 2017 and encrypted data on infected computers. 1
  2. A payment was demanded to restore access. A researcher activated a kill switch that stopped WannaCry locking further devices. 1
  3. The National Audit Office later investigated the effect on the NHS in England. The NCSC has withdrawn its WannaCry guidance for enterprise administrators, saying the page is out of date. That withdrawn page is not current advice. 13

Real UK example

The National Audit Office investigation is dated 27 October 2017. It records disruption in at least 34% of trusts in England. At least 81 out of 236 trusts were affected. A further 603 primary care and other NHS organisations were infected, including 595 GP practices. NHS England identified 6,912 appointments that did not go ahead. It estimated that the total would have been over 19,000. The Department and NHS England did not know the full extent of the disruption. The Department did not know how much the disruption to services cost the NHS. The Department, NHS England and the NCA told the NAO that no NHS organisation paid the ransom. The NAO also records that the attack could have caused more disruption without the kill switch. 1

Warning signs

  • A current ransomware incident is being handled with withdrawn 2017 administrator advice, rather than the current NCSC ransomware guidance. 23
  • Known security updates are left unapplied on systems that still run important work. 12
  • There is no list of important systems, and no recovery plan, before a disruption happens. 2

What to do now

  1. For a current ransomware incident, follow the NCSC ransomware hub, not withdrawn WannaCry administrator pages. 23
  2. Keep systems updated, and know what you run, so that known weaknesses can be fixed. 21
  3. Have a recovery plan, including backups you can restore, before an incident happens. 2

UK reporting and support

  • For a live cyber attack in England, Wales or Northern Ireland, use Report Fraud. Telephone support is also available on 0300 123 2040. 45
  • In Scotland, call Police Scotland on 101. 78
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 6
  • If someone is in danger, call 999. 78

How to protect yourself

  • Apply security updates and replace systems that no longer receive them. 2
  • Keep backups you can restore, and test that they work. 2
  • Plan who makes decisions if systems become unavailable. 2

Frequently asked questions

What was the WannaCry attack on the NHS, and could something like it still happen?

The NAO records that WannaCry was released worldwide on 12 May 2017 and was the largest cyber attack to affect the NHS in England. The figures below are from that 2017 investigation. A later incident would need current NCSC ransomware advice, plus updates and a recovery plan. No page can say whether an identical attack will happen again. 12

Did any NHS organisation pay the ransom?

The Department, NHS England and the NCA told the NAO, in the investigation dated 27 October 2017, that no NHS organisation paid the ransom. 1

What was the full cost to the NHS?

The NAO records that the Department and NHS England did not know the full extent of the disruption. The Department did not know how much the disruption to services cost the NHS. That report does not give a single UK-wide total. 1

Matching kit

First Hour After a Breach · £29 · Digital download.

An incident-response planning kit for UK small businesses. It is not a live incident-response or legal service.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. National Audit Office, Investigation: WannaCry cyber attack and the NHS | National Audit Office. Accessed 10 November 2026 (Europe/London).
  2. NCSC, What you need to know about ransomware | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. NCSC, Ransomware: WannaCry guidance for enterprise administrators (withdrawn) | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  5. Report Fraud, Guide to reporting cyber crime and fraud - Report Fraud. Accessed 10 November 2026 (Europe/London).
  6. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  7. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  8. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).