WannaCry, Revisited: What the NHS Attack Still Teaches Healthcare IT About Cyber Resilience

On 12 May 2017, a piece of self-spreading ransomware brought parts of England's National Health Service to a standstill in a single afternoon. Ambulances were diverted, non-urgent surgeries were postponed, and staff at affected trusts were locked out of patient records with nothing more than a ransom note on screen. Almost a decade later, WannaCry is still the reference case every healthcare CISO reaches for — not because the malware itself was sophisticated, but because the conditions that let it spread so far inside the NHS are still common in healthcare IT environments today: unpatched legacy systems, thin visibility into what's actually connected to the network, and identity management processes that were never built to scale.

This article walks through what actually happened, why the NHS in particular was so exposed, how one NHS trust rebuilt its approach to identity and account management in the years after, and how the UK's Cyber Essentials framework gives healthcare IT teams a concrete checklist for closing the same gaps before the next incident, not after.

What made WannaCry different

WannaCry combined two things that are individually common but rarely paired together: a working exploit for a serious Windows vulnerability, and a worm component that let it spread without any user clicking anything. The vulnerability, nicknamed EternalBlue, sat in the SMBv1 file-sharing protocol and had originally been developed as an offensive tool by the US National Security Agency. It leaked publicly in early 2017 via a group calling itself the Shadow Brokers, and within weeks it had been weaponized into ransomware.

Once WannaCry landed on a single unpatched machine, it didn't need a phishing click or a second stage download to move further — it scanned the local network and the wider internet for other machines running the same vulnerable SMB service and copied itself across automatically, encrypting files as it went. Microsoft had actually shipped a patch for EternalBlue two months earlier, in March 2017, which is precisely why this incident became the textbook case for patch management: the fix existed and was publicly available well before the outbreak, and organizations that had applied it were untouched.

The outbreak was contained faster than it might have been only because a security researcher discovered and registered an unregistered domain name hardcoded into the malware, which acted as an accidental kill switch. But by the time that happened, the damage across thousands of unpatched machines worldwide was already done, and for infected devices with no backup to restore from, the encrypted files stayed inaccessible regardless.

The NHS attack: scale and real-world impact

WannaCry infected roughly 200,000 devices across more than 150 countries, and the NHS accounted for a disproportionate share of that damage — close to 70,000 devices across English trusts were affected in some way, whether directly encrypted or simply taken offline as a precaution. Around 80 NHS trusts and hundreds of GP practices reported disruption, and because patient records, scheduling systems, and diagnostic equipment were suddenly unreachable, the practical consequence was that non-priority surgeries were postponed and appointments were cancelled at scale.

No patient records are known to have been exfiltrated or exposed as part of the attack, which is a genuinely important distinction from a data-breach incident — but it doesn't make the episode less serious. A hospital that can't safely access a patient's history, allergies, or current medication isn't just facing an IT outage; it's facing a direct patient-safety problem. Independent estimates put the financial cost of the disruption at close to £92 million (roughly $92 million) once cancelled activity, IT recovery, and additional support are accounted for, even though the NHS never paid the ransom itself.

WannaCry didn't steal a single patient record from the NHS — and it still managed to cancel surgeries, divert ambulances, and cost close to £100 million in disruption. Availability failures hurt healthcare organizations just as much as confidentiality failures do.

Why the NHS was an easy target

Several factors combined to make the NHS more exposed than a typical large enterprise would have been:

• Legacy operating systems. A meaningful portion of NHS estate was still running Windows XP and other operating systems Microsoft had already stopped supporting with routine security updates, leaving them permanently unpatched against vulnerabilities like EternalBlue by the time it surfaced.
• Budget pressure on IT and security. Like most public health systems, NHS trusts operate under tight budget constraints, and cybersecurity investment has historically had to compete directly with frontline clinical spending — a competition it frequently loses, even when the long-term cost of an incident dwarfs the cost of prevention.
• A large, flat, interconnected network. The N3 network connecting NHS sites across England meant that once WannaCry got a foothold anywhere on it, the worm behavior gave it a wide, poorly segmented surface to spread across, rather than being contained to a single site or department.
• Prior warnings that weren't acted on. The NHS had received earlier guidance about the risks of unsupported systems and inadequate patching, but the scale of the eventual attack still outpaced the preparedness on the ground.

The pattern here generalizes well beyond the NHS: healthcare IT environments tend to run a mix of clinical devices, legacy servers tied to specific software that can't easily be upgraded, and general-purpose Windows infrastructure — and the weakest link in that mix usually determines how far an attack can travel, not the strongest.

The Bedfordshire Hospitals case study

Bedfordshire Hospitals NHS Foundation Trust, which serves around 1.3 million patients with a workforce of more than 8,000 staff, is a useful case study precisely because its post-WannaCry problems weren't exotic — they were the same operational gaps most mid-sized healthcare organizations still carry today.

The trust's IT team had limited visibility into its own asset estate, which made patch management inconsistent: patches went out, but nobody had a reliable way to confirm which devices had actually received them and which had silently fallen behind. Active Directory administration relied almost entirely on the Microsoft Management Console and hand-written PowerShell scripts — functional, but slow, hard to audit, and entirely dependent on a small number of people who knew the scripts. On top of that, user account management was largely manual: stale and disabled accounts accumulated rather than getting cleaned up, bulk account creation for new starters was tedious, and password reset cycles generated a steady stream of help desk tickets from staff who'd forgotten a password they'd just been forced to change. Layered on top of all of this was a compliance obligation the trust couldn't fully satisfy: under the UK GDPR and Data Protection Act, they needed to be able to show who had accessed sensitive patient files and when, and their existing tooling simply didn't give them that visibility.

The fix wasn't a single product so much as a shift in approach: the trust adopted an identity governance and administration platform to take over day-to-day Active Directory account management, replacing ad hoc scripting with automated, auditable workflows. Stale and disabled accounts started getting identified and processed automatically instead of accumulating indefinitely. Routine account issues like lockouts moved to self-service, which cut the volume of tickets reaching the service desk and freed IT staff for higher-value work. And a behavior-driven auditing layer gave the trust the file-access visibility it needed to actually demonstrate GDPR and DPA compliance instead of asserting it.

Cyber Essentials and user lifecycle management

The UK's National Cyber Security Centre (NCSC) runs Cyber Essentials, a certification scheme launched in 2014 to give organizations of any size a baseline against common cyberattacks. It's built around five core technical controls, and while the scheme frames them broadly, each one has a direct, practical connection to how an organization manages user identities day to day.

• Firewalls. A properly configured boundary between your network and the internet — the control that, applied consistently across NHS sites, would have blocked much of WannaCry's inbound spread over SMB in the first place.
• Secure configuration. Devices and services shipped and maintained in a hardened state rather than default settings — which extends naturally to disabling unused accounts and turning off legacy protocols like SMBv1 that have no business being reachable from the wider network.
• User access control. Every account should carry only the access its owner actually needs, administrative rights should be separated from everyday accounts, and there should be a defined process for granting, changing, and revoking access as people join, move within, or leave the organization — precisely the joiner-mover-leaver discipline that was missing at Bedfordshire before its overhaul.
• Malware protection. Endpoint defenses that catch known malicious payloads before they can execute or spread further.
• Security update management. Timely patching of operating systems and applications — the single control that, on its own, would have prevented the vast majority of WannaCry infections, since Microsoft's fix predated the outbreak by two months.

Cyber Essentials guidance goes further than the five headline controls when it comes to identity specifically, calling for a documented review process for new account creation, least-privilege account design, minimal and controlled use of administrative privileges, strong authentication including multi-factor authentication where feasible, and — critically — regular review and removal of access rights that are no longer needed. Since its January 2022 update, the scheme also explicitly covers cloud services and requires MFA on accounts, reflecting how much healthcare IT has shifted toward hybrid and cloud-hosted infrastructure since 2017.

None of this is achievable through good intentions alone at NHS scale. A trust with thousands of staff, rotating clinical rotations, agency and contract workers, and dozens of connected systems needs automated tooling to keep account creation, access reviews, and deprovisioning consistent — which is exactly the operational gap that turned Bedfordshire's manual, script-driven AD administration into a recurring source of risk until it was replaced with a managed, auditable process.

Common mistakes to avoid

Treating patching as a one-off project instead of a standing process. Microsoft's EternalBlue patch existed for two months before WannaCry hit — the failure wasn't a lack of a fix, it was a lack of a reliable, continuously monitored process for confirming every device actually received it. Asset visibility has to come before patch compliance can mean anything.

Letting Active Directory administration depend on a handful of scripts and a handful of people. Manual PowerShell-driven AD management scales badly, is hard to audit, and creates a single point of failure when the one person who understands the scripts is unavailable. Bedfordshire's experience shows how quickly this becomes a genuine security gap, not just an inconvenience.

Letting stale accounts accumulate. Every disabled-but-not-deleted account, every contractor login left active after a placement ends, is a standing attack surface. Regular, automated account reviews aren't a nice-to-have compliance exercise — they directly reduce the number of ways an attacker (or a ransomware worm exploiting a compromised credential) can move through your environment.

Frequently asked questions

Could WannaCry happen again today?
The specific EternalBlue exploit is now patched almost everywhere, and SMBv1 has been disabled by default on modern Windows systems, so an identical outbreak is unlikely. But the underlying pattern — a known, patched vulnerability left unaddressed on enough machines to let a worm spread — remains entirely plausible with any future exploit, especially in environments still running unsupported legacy systems.

Is Cyber Essentials mandatory for NHS trusts and healthcare suppliers?
Cyber Essentials itself is a voluntary scheme open to any UK organization, though it's been a mandatory requirement for suppliers to central government handling certain sensitive data since 2014. Separately, NHS organizations in England must complete the annual Data Security and Protection Toolkit self-assessment, which covers similar ground around access control, patching, and incident response.

What's the single highest-leverage change a healthcare IT team can make after reading about WannaCry?
If forced to pick one, it's closing the gap between "we have a policy" and "we can prove the policy is being followed" for both patch management and account lifecycle management. Automated tooling that gives you a real-time, auditable view of both is what actually prevents a repeat of what happened at Bedfordshire and across the wider NHS in 2017.

WannaCry is now old enough that some healthcare IT teams weren't in their current roles when it happened — but the conditions that made it so damaging haven't gone away, they've just moved. Legacy systems still linger in clinical environments that can't easily be upgraded, identity sprawl still accumulates in large organizations with high staff turnover, and budget pressure still pits security spending against frontline care. The lesson from the NHS attack was never really about one exploit; it was that visibility into your assets and your identities is what turns a contained incident into a footnote instead of a headline.