1
Wanna Cry Ransomware Attack
Haziel Landaverde
Idaho State University
Informatics 4380: Networking and Cybersecurity
Prof. Robert Houghton
December 12, 2025
2
Cyberattacks have slowly become of the biggest challenges organizations are facing worldwide,
with ransomware being one of the more common destructive forms. WannaCry, was a
ransomware attack that happened in May 2017, targeting computers running older versions of
Microsoft windows, encrypting files and demanding bitcoin to get them back. This malware
spread quickly across various networks, exploiting vulnerabilities and highlighting the risk of
outdated software. Among the affected, the UK’s national health service (NHS) became heavily
affected due to them relying on outdated systems for protecting healthcare services.
Though the NHS had been warned for years about the potential of a cyberattack, they decided to
trust older software such as Windows XP. However, when the malware became introduced to
their systems, it spread fast, infecting at least 80 out of 236 NHS trusts. Devices became locked,
files encrypted, and services such as surgeries were disrupted. Ambulances and patients had to
go elsewhere, and staff had to go back to paper as their main system. This attack demonstrates
how a single vulnerability can compromise and halt operations of such an important place as a
hospital.
The NHS response was to activate emergency protocols, including the advice in not to
pay the ransom and hiring a cybersecurity researcher who triggered a kill-switch to prevent the
malware from spreading further. Other organizations also worked with national authorities and
law enforcement while their IT teams worked to restore their operations. This response
minimized the damage that could have happened resulting in no patient data being stolen. In
total, the NHS responded well despite the amount of disruption the ransomware caused.
Bruce Shneiders methodology for SolarWinds Hack.
3
1. What assets where they trying to protect
The assets they were trying to protect were sensitive patient data and keeping their
normal operations running, which is all digital based now.
2. What are the risks to these assets
The risks to these assets are theft of patient information, unauthorized access to important
tools, and disrupting the service a hospital is meant to produce.
3. How well does the security solution mitigate those risks?
Patch systems and the IT teams updating the operating systems while they worked on
fixing the issue proved to be efficient in mitigating the damage from the attack.
4. What other risks does the security solution cause?
System updates and patches such as upgrading to a newer version of windows could
cause compatibility issues with older medical software causing temporary downtime.
5. What costs and trade-offs do the security solution impose?
The costs the security solution imposed were mostly financial costs due to purchasing a
software license and hiring extra people to help stop the ransomware attack.
What I would have done differently
Although the NHS did a good job in preventing the expansion of the ransomware
attack, I would have enforced automatic updates and prohibited the use of older operating
systems for all systems to prevent a situation like this from happening again. Regular
cybersecurity drills and staff training would also have to improve awareness and improve
response time in case of any future attacks.
In conclusion, the WannaCry attack demonstrates how cyber-attacks can disrupt critical
services such as healthcare when basic practices are ignored. While essential
4
cybersecurity practices such as patches and firewalls were used, staff training, protocols,
and constant monitoring of the systems are equally important. From this incident,
organizations can see the consequences of poor cybersecurity hygiene and better
safeguard their sensitive data and maintain good service.