WannaCry and England's Hospitals — A Week at Hospitals That Were Never the Target

Friday Morning, Hospitals That Were Not the Targets

On Friday, May 12, 2017, a ransomware called WannaCry locked computers around the world. Ransomware is malicious software that makes files unusable—such as by encrypting them—and then demands money in exchange for unlocking them, a term covered in the Security from Scratch primer "Phishing and Social Engineering — Ringing the Doorbell Instead of Breaking the Lock". The UK National Audit Office (NAO) noted that this attack affected more than 200,000 computers in at least 100 countries (National Audit Office investigation report). In the UK, the entity hit especially hard was the National Health Service, or NHS, the public healthcare system. Yet the NHS was not the target of this attack (National Audit Office investigation report). Even though no one deliberately singled out hospitals, hospital operations were thrown into turmoil.

The setting of this article is England. The NHS in England operates by dividing into hundreds of organizations. A trust is an organizational unit that manages and operates hospitals or local healthcare services within the English NHS. There are 236 trusts in England. While the Department of Health bears national responsibility for cybersecurity and incident response in the health sector, the actual management of cybersecurity is left to local organizations such as trusts and neighborhood clinics (GP surgeries) (National Audit Office investigation report). This structure, in which the center holds responsibility and the field manages operations, returns later in the story titled "Alarms Were Sent, But Cannot Be Enforced".

Warnings had been given in advance. In 2014, the Department of Health and the Cabinet Office sent a letter stating that trusts must have a "robust plan" to migrate away from old software like Windows XP by April 2015. In July 2016, the National Data Guardian and the Care Quality Commission (CQC) warned that cyber attacks could block access to patient record systems (House of Public Accounts Committee report). According to the NAO, the Department of Health was warned about this risk a year before the attack and was working on it, but did not issue an official written response until July 2017 (National Audit Office investigation report). Hospital ransomware was not a first either. In October 2016, Northern Lincolnshire and Goole NHS Foundation Trust cancelled 2,800 appointments due to a ransomware attack, and for Barts Health NHS Trust, WannaCry was the second cyber attack in six months (National Audit Office investigation report).

Public documents recording this day are four. The National Audit Office investigation report is an investigation published in October 2017 by an independent body that audits public spending for Parliament. The Department of Health commissioned lessons learned review is a government and NHS self-assessment published in February 2018, commissioned by the Department of Health’s Data Security Leadership Panel from William Smart, Chief Information Officer (CIO) for health and care in England. The House of Public Accounts Committee report is a parliamentary investigation published in April 2018 after calling the Department of Health and NHS agency heads as witnesses based on the NAO report. The UK Foreign Office statement is a government announcement made in December 2017 identifying who the attackers were. The four documents differ slightly in their numbers and evaluations of the same day.

4:00 PM, a National Major Incident

Late in the morning on the 12th, the first trusts began reporting problems. At 1:06 PM, the emergency preparedness team at NHS England, the central body leading NHS England, first received news of the attack, and at 4:00 PM, NHS England declared this cyberattack a national major incident. At 6:45 PM, NHS England decided to lead the response (UK National Audit Office investigation report).

That evening, a cybersecurity researcher triggered a kill switch, and after that, WannaCry locked no more devices (UK National Audit Office investigation report). A kill switch is a device built into software in advance to stop that software or device in an emergency when it cannot be turned off by ordinary methods. This definition is in a footnote of the National Audit Office report. A Department of Health-commissioned lessons learned review judged that without this intervention, the impact of WannaCry on patient care would likely have been much greater (Department of Health-commissioned lessons learned review). The locking stopped on the evening of the first day, but reviving already locked devices and blocking Monday's new wave of infections started from then.

Communication was cut off first. Many trusts were infected or had turned off email as a precaution, making it impossible to communicate by email with nationwide bodies. Field staff shared information using personal mobile phones, even using the encrypted messenger WhatsApp. Although it was not an official communication method, nationwide bodies and trusts told the National Audit Office that it worked well in this incident (영국 감사원 조사 보고서).

The work continued through the weekend. National and local NHS staff worked overtime over the weekend of the 13th to 14th to solve problems and prevent a new wave of infections at other bodies on Monday the 15th. NHS England's IT team did not have an on-call system, but staff volunteered to come in (영국 감사원 조사 보고서). NHS England's response had three stages. From the 12th to the 14th, they focused on protecting the flow of emergency care; from the 13th to the 15th, on stabilizing primary care such as general practices; and from the 15th to the 19th, on recovery. NHS England stood down its incident response at 5:30 PM on Friday, May 19th (영국 감사원 조사 보고서). It took a full week.

What Stopped — 80 Places, or 48

The National Audit Office recorded that out of 236 English trusts, at least 80, or at least 34%, experienced disruption. Thirty-four trusts were infected and had their devices locked, while 46 reported disruption even though they were not infected (UK National Audit Office investigation report). This number is a lower bound. It relies on problems reported by the institutions themselves and the results of NHS England and NHS Digital (the central agency in charge of NHS information technology) analyzing internet activity, so it could be larger if some institutions did not report accurately on time. The Department of Health and NHS England also do not know the full picture of the disruption (UK National Audit Office investigation report).

The same numbers differ from document to document. When the audit office first released its report, the number of affected trusts was 81, but 4 trusts challenged the classification, so it was corrected to 80 (Department of Health commissioned lessons learned review). On the other hand, a UK Foreign Office announcement stated "48 NHS trusts," and did not disclose what was counted to reach 48 (UK Foreign Office announcement). Among the 34 infected trusts, the audit office recorded 25 acute hospital trusts, while the lessons learned review recorded 27 (UK National Audit Office investigation report; Department of Health commissioned lessons learned review). The scale of damage is a number with "at least" attached, and it changes depending on which document you open.

The disruption at the 46 uninfected trusts came from decisions they made themselves. These trusts did not receive central guidance early enough on the 12th to judge what to do, so they turned off email and other systems themselves as a preventive measure. As a result, they did what they usually did electronically using pen and paper (UK National Audit Office investigation report). Outside the trusts, primary care including 595 GP practices and 603 other NHS bodies were infected (UK National Audit Office investigation report).

What stopped in the infected trusts was largely twofold. One was people. Staff were locked out of devices and could not view or modify patient information, and sending test results to patients' local clinics, transferring patients to other hospitals, and discharging them were blocked or delayed. The other was equipment. Medical equipment was locked or disconnected from the network to prevent it from being locked, which shook radiology and pathology departments. The trusts were relying on that equipment for diagnostic imaging such as MRIs and blood and tissue tests (UK National Audit Office investigation report). By May 19, the diagnostic equipment confirmed infected by NHS England was 1,220 units, which was 1% of the NHS's total such equipment. Equipment disconnected to prevent infection is not included in this number (UK National Audit Office investigation report).

Cancelled Appointments, Turned-Away Ambulances

The number of cancelled appointments remains at three. Cancellations confirmed by NHS England for the 12th to 18th stood at 6,912. This excludes follow-up outpatient visits and cancellations confirmed after the 18th. NHS England estimated the total cancellations at roughly 19,494 based on the ratio of follow-ups to initial appointments in normal times, but told the National Audit Office that it had no plans to verify the actual number (National Audit Office investigation report). The House of Commons Committee wrote that "nearly 20,000 hospital appointments and procedures" had to be cancelled (House of Commons Public Accounts Committee report), though the committee did not disclose the source of this figure. This number is close to the estimate of approximately 19,494 provided by the Audit Office, rather than a confirmed count. The lessons learned review recorded the same 6,912 as 1.2% of that week's initial appointments (Lessons learned review commissioned by the Department of Health). The confirmed cancellations are 6,912, approximately 19,494 is an estimate, and NHS England stated it has no plans to verify the actual number.

Cancer care was also delayed. In NHS England's own review, at least 139 patients experienced cancellations of urgent referrals suspected of cancer up to the 18th, and the actual figure may be higher (National Audit Office investigation report). The lessons learned review recorded the same 139 as roughly 0.4% of urgent cancer referrals (Lessons learned review commissioned by the Department of Health). The exact same headcount comes with "at least" and "may be higher" attached in the Audit Office report, while appearing as a percentage in the lessons learned review.

Some emergency departments had to turn patients away. Emergency department diversion is when a hospital emergency department cannot accept patients and redirects ambulances and patients to another hospital's emergency department. Of the 25 infected acute trusts, 20 continued to receive emergency patients throughout the weekend. However, five trusts in London, Essex, Hertfordshire, Hampshire, and Cumbria had to divert patients to other emergency departments, and two had to receive external help to continue seeing patients (National Audit Office investigation report). According to the lessons learned review, when one emergency department could no longer take patients, a "mutual aid" procedure kicked in where nearby emergency departments absorbed the excess demand, and some patients from the five hospitals traveled farther than usual to receive emergency treatment (Lessons learned review commissioned by the Department of Health). Documents also slightly differ on when the diversions ended. The Audit Office noted that on Tuesday the 16th, two hospitals—Lister Hospital in Hertfordshire and Broomfield Hospital in Essex—were still diverting patients (National Audit Office investigation report), whereas the lessons learned review stated that diversions were lifted on the 16th (Lessons learned review commissioned by the Department of Health).

The number of turned-away patients is not preserved. Because data was not collected during the incident, neither the Department of Health nor NHS England knows how many primary care appointments were cancelled or how many ambulances and patients were redirected elsewhere from those five emergency departments (National Audit Office investigation report).

Documents are also cautious when describing patient harm. NHS organizations reported no instances where patients suffered harm or data was exposed or stolen. NHS England told the Audit Office it expects that had such events occurred, trusts would have reported them through existing reporting channels (National Audit Office investigation report). The lessons learned review recorded the same fact more positively. It stated that the NHS responded well to an unprecedented incident, that there were no reports of patient harm or patient data exposure or theft, and that WannaCry directly impacted 1% of NHS activity (Lessons learned review commissioned by the Department of Health). "There were no reports of harm" means the organizations did not report any, which is different from confirming that no harm occurred. Financial costs are also only half-known. The Department of Health, NHS England, and the National Crime Agency stated that no NHS organization paid the ransom, but the Department of Health does not even know how much the service disruptions cost the NHS (National Audit Office investigation report).

The Computers That Weren't Fixed

What NHS Digital told the National Audit Office was this: all NHS organizations infected by WannaCry were either using unpatched or unsupported Windows operating systems, which is why they fell victim to this ransomware. And whether they had applied patches or not, managing the firewalls facing the internet would have prevented infection (National Audit Office investigation report). End of support is the state of an operating system or program where the company that made it no longer releases security updates. A patch is a revision that fixes vulnerabilities in a program already released and sends it back out, which was covered in the Security from Scratch primer "Security — Unseen by Others, Unchanged in Secret, Open When Needed".

The majority of infected devices were not unsupported machines. NHS Digital stated that most infected NHS devices were running Windows 7, which was still supported, but had not been patched, and that unsupported XP machines made up a minority of the confirmed issues. Microsoft released a patch in March 2017 fixing the weakness that WannaCry later burrowed into, and NHS Digital asked trusts to apply that patch through security alerts (CareCERT) issued on March 17 and April 28. The National Audit Office noted that trusts using Windows 7 could have protected themselves with that patch (National Audit Office investigation report). The lessons learned review pointed in the same direction, stating that this was "an attack exploiting a specific Windows vulnerability, rather than an attack on unsupported software" (Lessons learned review commissioned by the Department of Health).

Even so, XP remained a separate problem. The XP used by some trusts was in an end-of-support state, meaning Microsoft no longer issued patches. What was trickier were medical devices with XP embedded inside the equipment, like MRIs. These devices were usually managed by the manufacturers, so trusts could not update them directly, and according to NHS England and NHS Digital, manufacturer support was often inadequate (National Audit Office investigation report). On the day of the attack, the Department of Health stated that about 5% of NHS IT assets, including computers and medical devices, were still running XP (National Audit Office investigation report), and the House of Commons committee recorded that proportion at 4.7% at the time of the attack (House of Commons Public Accounts Committee report). To use a house as an analogy, the homeowner did not have the key to fix the window; only the company that installed the window did.

There was a reason WannaCry spread quickly within an organization. A worm is malware that spreads by itself across a network from this computer to that computer without a person opening files. According to the National Audit Office, WannaCry exploited a weakness in a part of Windows used for sharing files within organizations to spread automatically in some cases, and organizations with large Windows networks were among the hardest hit. Trusts that were infected tended to have more staff than average (National Audit Office investigation report). The lessons learned review called WannaCry a "cryptoworm" and noted that the initial infection likely came through vulnerable points exposed to the internet rather than email phishing, as was first guessed (Lessons learned review commissioned by the Department of Health). If one remembers this incident through the story of a single employee opening the wrong email, it conflicts with the path drawn by the lessons learned review.

The documents diverge most on how well patching was done. The lessons learned review noted that out of 80 NHS organizations affected by WannaCry, not a single one had applied the patch recommended by the April 25 CareCERT alert, and added in a footnote that it was a recommendation, not an instruction, and that NHS Digital had no power to compel organizations (Lessons learned review commissioned by the Department of Health). In the House of Commons committee, NHS Digital stated that patches had been applied in well over two thirds of trusts at the time of the attack, and the committee's conclusion section framed this same fact as having been patched in "only about two thirds" (House of Commons Public Accounts Committee report). The lessons learned review's "0 out of 80" counted affected organizations, while the House of Commons committee's "two thirds" counted all trusts, so the two numbers have different denominators. Both could be correct if they counted different groups, but the documents do not explain the relationship between the two.

There are also answers as to why patching was delayed. According to the lessons learned review, more than half of local NHS organizations had not patched when needed, and reported as the reason that they worried about the downtime required for patching affecting patient care (Lessons learned review commissioned by the Department of Health). The House of Commons committee noted the same difficulty: patches could interfere with the use of medical equipment and pose clinical risks to patients, and patching one part of an IT system could destabilize other parts of that system (House of Commons Public Accounts Committee report). The committee also cited testimony from NHS Digital itself that it had only 18 to 20 people with "deep technical capabilities" (House of Commons Public Accounts Committee report). The reason cited by more than half of local organizations for delaying patches was concern over disruption to patient care.

Patching was not the only layer. Defense in depth is an approach of layering multiple defenses of different natures so that even if one layer is pierced, the next layer can block or detect it. NHS Digital and NHS England told the House of Commons committee that even if patching is difficult, organizations could protect themselves by managing firewalls, segmenting networks so that not all devices can reach each other, and especially by keeping medical devices isolated from the network (House of Commons Public Accounts Committee report).

Where to place the weight of the cause differed by organization. NHS England viewed that WannaCry infected parts of the NHS primarily because organizations failed to maintain good security practices. NHS Digital viewed that it was not due to lax cybersecurity, but rather because trusts did not well understand the nature of cyber risk. Trusts did not view cybersecurity as a risk to patient outcomes and overestimated their preparedness to respond (National Audit Office investigation report).

An Untested Contingency Plan

Devices to check the field were also weak. Before the attack, there was no official apparatus to verify whether alerts had been implemented. Prior to the attack, NHS Digital conducted on-site cybersecurity inspections across 88 trusts out of 236, and none passed; NHS Digital could not force any organization to take action even if it was worried (UK National Audit Office Investigation Report). By early 2018, when the House of Commons committee released its report, the number of inspected trusts had risen to 200, and all of them failed. There was an explanation that the standards were high, but some trusts failed because they still had not patched their systems at that time. The committee noted failing to patch as the primary reason why the NHS was vulnerable to WannaCry (House of Commons Public Accounts Committee Report).

There was a contingency plan, but it was untested. An incident response plan is a pre-arranged plan that determines who does what and who is notified when an attack occurs. According to the National Audit Office, the Department of Health had created a plan containing the roles and responsibilities of national and regional organizations to respond to an attack, but it had not been tested at the local level. Therefore, it was not clear what the NHS should do when it was hit by WannaCry. The National Audit Office added that cyberattacks are less visible than other incidents and do not stay confined to one region like a major traffic accident, taking more time to figure out the cause and scale (UK National Audit Office Investigation Report). According to the House of Commons committee, NHS England activated its emergency response plan three hours after declaring a major incident, and NHS England agreed that this was too slow (House of Commons Public Accounts Committee Report).

Evaluations of the response diverge the most across documents. A self-inspection, the lessons-learned review, recorded that the NHS responded well to an unprecedented incident and that managing the incident through the official emergency framework was a success (Lessons-Learned Review Commissioned by the Department of Health). A parliamentary investigation, the House of Commons committee report, viewed that the Department of Health and its subordinate organizations were not prepared for a "relatively simple" WannaCry attack. And it wrote that the NHS was lucky. If the attack had not occurred on a Friday afternoon in the summer, or if the kill switch had not been found relatively quickly, the disruption could have been much greater (House of Commons Public Accounts Committee Report). The report by the independent auditor, the National Audit Office, wrote that it was unclear what to do because of the untested plan. Regarding the exact same week, the government and NHS side's self-inspection wrote that they "responded well," while the parliamentary committee wrote that they "were lucky."

The phrase "relatively simple" comes with a basis. The House of Commons committee noted that because WannaCry was ransom-seeking ransomware, it only locked devices and did not try to alter or steal data, and that future attacks could be more sophisticated and lead to patient data theft (House of Commons Public Accounts Committee Report). NHS Digital also told the National Audit Office that analysis suggested it was not an attack targeting data, but they did not know for sure (UK National Audit Office Investigation Report). The lessons the NHS compiled for itself were four: a response plan detailing what to do during a cyberattack and the roles of each organization, the implementation of alerts such as patches, communication methods that work even when systems are shut down, and the board and staff taking threats seriously (UK National Audit Office Investigation Report).

Among the four documents, only a Foreign Office statement pointed the finger at the attacker. On December 19, 2017, Lord Ahmad, the UK Foreign Office cybersecurity minister, announced that the UK National Cyber Security Centre (NCSC) assessed it as "highly likely" that North Korean actors known as the "Lazarus Group" were behind WannaCry (UK Foreign Office Statement). The statement did not include the evidence data for that assessment. The same statement recorded the scale of damage as 300,000 devices across 150 countries, which differs from the National Audit Office's over 200,000 devices across at least 100 countries and the lessons-learned review's over 230,000 devices across at least 150 countries following a Europol report (UK Foreign Office Statement; Lessons-Learned Review Commissioned by the Department of Health). The National Audit Office, lessons-learned review, and House of Commons committee reports do not name the attacker. The House of Commons committee only noted that it was for financial motives (House of Commons Public Accounts Committee Report).

A Study That Recounted That Week's Hospital Records

That week's medical care was counted again afterward in hospital records. This is an analysis comparing outpatient cancellations, emergency and elective admissions, emergency department visits, and emergency department deaths during the WannaCry week with normal times, using England's Hospital Episode Statistics (HES) (PMID 31602404). This study is the sole piece of evidence we examined that directly measured, specifically for this incident, what the documents failed to count. When combining all trusts, the volume of care that week showed no significant difference from normal times. Trusts had 1% more emergency admissions and 1% fewer emergency department visits per day on average (PMID 31602404). The differences arose in the infected hospitals. Hospitals directly infected by the ransomware saw total admissions decrease by roughly 6% per hospital per day, emergency admissions decrease by 4%, and elective admissions decrease by 9%. The economic value of the care reduced in infected trusts was estimated at 5.9 million pounds (PMID 31602404).

No difference was observed in emergency department deaths. However, the authors noted that no increase in mortality was reported, while immediately adding that this is a crude measure of patient harm. They also concluded that further research is needed to understand the impact of cyberattacks or IT failures on medical care and patient safety (PMID 31602404). What the study that directly measured this incident observed was a decrease in the volume of care at infected hospitals, and while there was no difference in emergency department deaths, the authors themselves noted that the measure was crude.

Different Countries, Different Hospitals in Different Years

The studies in this section did not measure just the single WannaCry incident. Most of them use data from U.S. hospitals and measure different attacks in different years, so the numbers cannot be directly transferred to that single week in England. Instead, they show what hospital ransomware generally does.

Hospital ransomware has increased in the United States. Between 2016 and 2021, 374 ransomware attacks suffered by U.S. healthcare organizations were identified, and the annual number of attacks more than doubled from 43 to 91 (PMID 36580326). Among them, 44.4% disrupted patient care, with electronic system outages, canceled scheduled appointments, and ambulance diversions being common disruptions. The authors noted that the information provided by current surveillance and reporting systems is limited (PMID 36580326).

Some studies even measured patient outcomes. "Hacked to Pieces?", published in a U.S. economics journal in 2026, compiled a list of hospital ransomware attacks and linked it to Medicare claims data, which is U.S. public health insurance for older adults (DOI: 10.1257/pol.20240594). In the first week of an attack, hospital care volume dropped by 17 to 24% and recovered within 3 weeks. In-hospital mortality for patients already admitted when the attack began increased by 34 to 38% (DOI: 10.1257/pol.20240594). This is an observational study linking claims data, and the subjects are U.S. Medicare patients. Placed side by side with the English study that found no difference in emergency department mortality, the results may seem to conflict, but the countries, years, attacks, and measured deaths are all different. In a study that looked separately at rural hospitals using Medicare data, admissions in the first week of an attack dropped by 14.7% in rural hospitals and 16.9% in urban hospitals, and the time and distance to the nearest unaffected hospital were 4 to 7 times longer for rural hospitals than for urban ones (PMID 38494590).

There are also records of unaffected neighboring hospitals being disrupted. When four hospitals belonging to a single healthcare organization in San Diego, U.S., were tied up by ransomware for a month in May 2021, the emergency departments of two nearby, unaffected university hospitals were busier than during the 4 weeks before the attack (PMID 37155166). During the attack period, these emergency departments saw increases in daily average patient volume and ambulance arrivals, as well as an increase in patients who left without being seen, and emergency stroke calls rose from 59 to 102 (PMID 37155166). The authors concluded that an attack on a targeted hospital can disrupt care at other hospitals in the region, so it should be treated as a regional disaster. In another analysis during the same period (May 2021) looking at two unaffected neighboring university hospitals, the proportion of out-of-hospital cardiac arrest patients with good neurological outcomes among 78 cardiac arrests at the two hospitals dropped from 40.0% before the attack to 4.5% during the attack, before returning to 41.2% after the attack (PMID 38605720). This is a study with a small number of cases at two hospitals, and the authors noted that neighboring hospitals 「may see worse outcomes」 in out-of-hospital cardiac arrest patients (PMID 38605720). In England, patients from five emergency departments went to neighboring emergency departments, but there is no data counting those numbers.

There are also records explaining why the time electronic records are down is dangerous. Looking at 76 patient safety incident reports identified as occurring while electronic health records were down, nearly half (48.7%) involved test orders and results, and 46% lacked or failed to follow downtime procedures (PMID 28575417). This is the exact same issue as infected trusts in England being unable to send test results. There are also surveys showing that U.S. hospital preparedness is thin. In a survey of 57 U.S. hospital emergency management personnel, 52.6% answered that their emergency operations plans did not specifically address cybersecurity, and the authors considered U.S. hospitals to be less prepared for cyber disasters (PMID 36945857). In a qualitative study interviewing 9 medical staff and IT personnel from emergency care settings following ransomware attacks, participants also stated that preparedness was lacking, and the authors noted that hospitals were extremely reluctant to participate in this study (PMID 37318433).

Difficulties on the medical device side were also measured. Searching public procurement records from over 36 countries, there were 661 different vulnerabilities in medical devices purchased by national health services (PMID 37945583). Even if patches were applied as soon as vulnerabilities were discovered, it is calculated that systems were exposed for an average of about 3.2 years from the time the device was purchased until the vulnerability was made public (PMID 37945583). This means that lingering vulnerabilities inside medical devices are not just the problem of a single country or a single hospital.

Unmeasured Harm

Right in the middle of the remaining questions sits the patient. The National Audit Office report noted that because data was not gathered during the incident, the number of ambulances and patients turned away is unknown, and NHS England had no plans to ascertain the true figure beyond the 6,912 confirmed canceled appointments (National Audit Office investigation report). Patient harm was left to the expectation that organizations would report it through existing channels, and none was reported (National Audit Office investigation report). A subsequent study measured via hospital records found a drop in care volume at infected hospitals, but no difference in mortality, while acknowledging its measures were crude (PMID 31602404).

So what this week did to patients is still not fully known. U.S. data has already measured an increase in mortality for patients already admitted and a burden on neighboring emergency rooms, but those numbers belong to different attacks in a different country. Data to bridge that gap—namely, data following what subsequently happened to cancer appointments delayed in England, or to emergency patients who took a long detour—is absent from the documents and studies examined in this article.

The Patient Beyond the Locked Screen

The causes contained in the documents lie across multiple layers rather than coming down to a single person's mistake. The House of Commons listed the failure to apply patches as the primary reason the NHS was vulnerable, while NHS England saw it as a failure of organizations to follow good security practices. Beneath that were warnings without the authority to be enforced, and over half of local organizations reported that they delayed patching out of concern for disrupted care. The old operating systems inside the equipment could not be fixed directly by the hospitals, and while plans existed, they had not been tested. Above all that, assessments were divided. Self-checks on the government and NHS side noted that they responded well, whereas the parliamentary committee noted that they were lucky.

When hospital operations are shaken, the damage does not end at locked screens; it leads to canceled appointments and distant emergency rooms. During the incident, data on the number of turned-away ambulances and patients, as well as the number of canceled local clinic appointments, was not collected, leaving neither the Department of Health nor NHS England knowing them by the time of the National Audit Office investigation.

What this day shook is the property that the "Security from Scratch" primer article "Security — Unseen by Others, Unchanged in Secret, Open When Needed" calls availability—in other words, the property that authorized people can actually use information and systems when needed. Why it takes a long time for even an available patch to reach actual machines continues through a different incident in the sister article "The Log4j Vulnerability — Who Finds the Part Buried in the Wall?". How an attack that did not target hospitals directly blocked the paths of medical billing and pharmacy prescriptions is covered in "The Change Healthcare Ransomware Attack — When One Claims Hub Stopped".

Case Documents

• "Investigation: WannaCry cyber attack and the NHS" (First published 2017-10-27, version received is the 2018-04-25 reissue) — https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/ — An independent investigation by the UK National Audit Office (NAO). Covering only the English NHS, from just before 2017-05-12 to 09-30. Damage scale, patient impact, causes, and response.
• "Lessons learned review of the WannaCry Ransomware Cyber Attack" (2018-02-01) — https://www.england.nhs.uk/wp-content/uploads/2018/02/lessons-learned-review-wannacry-ransomware-cyber-attack-cio-review.pdf — An internal government and NHS review commissioned by the Department of Health committee from NHS Chief Information Officer Will Smart. A timeline of events, damage figures, cause interpretations, and 22 recommendations.
• "Cyber-attack on the NHS" (2018-04-18) — https://publications.parliament.uk/pa/cm201719/cmselect/cmpubacc/787/787.pdf — A parliamentary inquiry by the House of Commons Public Accounts Committee. Evaluating lack of preparedness, communication, costs, and patching difficulties based on the NAO report and witness hearings.
• "Foreign Office Minister condemns North Korean actor for WannaCry attacks" (2017-12-19) — https://www.gov.uk/government/news/foreign-office-minister-condemns-north-korean-actor-for-wannacry-attacks — A UK Foreign Office press release. Attributing the attacker by citing the NCSC assessment, without containing the supporting evidence.

Source Papers

• "A retrospective impact analysis of the WannaCry cyberattack on the NHS." (2019) — PMID 31602404 — Analysis of English Hospital Episode Statistics (HES). Total trust care volume showed no significant difference from normal, infected hospitals saw about a 6% decrease in daily admissions (4% emergency, 9% elective), 5.9 million pounds, no difference in mortality — Authors: crude metrics, more research needed.
• "Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016-2021." (2022) — PMID 36580326 — 374 ransomware cases in US healthcare organizations, annual count increased from 43 to 91, 44.4% experienced care disruptions. Information from surveillance and reporting systems is limited.
• "Hacked to Pieces? The Effects of Ransomware Attacks on Hospitals and Patients" (2026) — DOI: 10.1257/pol.20240594 — Journal version. Linking hospital ransomware lists with Medicare claims data. Care volume dropped 17-24% in the first week of attack and recovered within 3 weeks, in-hospital mortality for already admitted patients increased by 34-38%.
• "What happens to rural hospitals during a ransomware attack? Evidence from Medicare data." (2024) — PMID 38494590 — Admissions dropped 14.7% for rural and 16.9% for urban hospitals in the first week of attack, recovering within 2 to 3 weeks. Rural areas experienced 4 to 7 times the time and distance to the nearest non-attacked hospital.
• "Ransomware Attack Associated With Disruptions at Adjacent Emergency Departments in the US." (2023) — PMID 37155166 — San Diego in 2021, two unattacked neighboring emergency departments saw increases in patient volume, ambulance arrivals, wait times, and stroke alerts. Authors: should be treated as a regional disaster.
• "Ransomware Cyberattack Associated With Cardiac Arrest Incidence and Outcomes at Untargeted, Adjacent Hospitals." (2024) — PMID 38605720 — 78 cardiac arrest cases at two neighboring hospitals during the same attack period. Good neurological survival for out-of-hospital cardiac arrest dropped from 40.0% to 4.5% and rebounded to 41.2%. Authors: worse outcomes can be seen.
• "Implications of electronic health record downtime: an analysis of patient safety event reports." (2018) — PMID 28575417 — Out of 80,381 incident reports, 76 were related to electronic health record downtime, 48.7% involved tests, and 46% involved non-compliance with or absence of downtime procedures.
• "A National Survey of Hospital Cyber Attack Emergency Operation Preparedness." (2023) — PMID 36945857 — 57 US hospital emergency managers, 52.6% did not specifically include cybersecurity in their emergency operations plans. Authors: underprepared.
• "Hacking Acute Care: A Qualitative Study on the Health Care Impacts of Ransomware Attacks Against Hospitals." (2024) — PMID 37318433 — Interviews with 9 clinicians and IT staff. Major impact on emergency care flow and staff, lack of preparedness, hospitals' reluctance to participate.
• "Cybersecurity vulnerability analysis of medical devices purchased by national health services." (2023) — PMID 37945583 — 92 million procurement records from over 36 countries, 661 medical device vulnerabilities, exposed for about 3.2 years even if patched immediately.