On Friday, May 12, 2017, hospital trusts in England started reporting strange problems late in the morning. At 1:06 pm the news reached NHS England's emergency preparedness team, and by 4 pm the health service had declared a major incident. What arrived that day was a worm the world soon knew as WannaCry: code that scans for other machines, breaks in through a programming flaw, and moves to the next one with no human involved anywhere. Nobody had to open an email. It just kept walking.
It went on to affect more than 200,000 computers in at least 100 countries. That evening a security researcher activated a kill switch built into the code, and the locking stopped. In England, at least 81 of 236 NHS trusts were affected, along with 595 GP practices. No NHS organization paid the ransom, and NHS Digital said it believed no patient data had been compromised or stolen. The bill arrived anyway.
Here is the number I keep returning to. The flaw the worm used had been fixed 59 days earlier. On March 14, 2017, Microsoft published MS17-010, a critical update for the Windows file-sharing protocol WannaCry used to spread. The update was free for every supported version of Windows. In March and April, NHS Digital had issued critical alerts warning organizations to patch their systems. The alerts went out. The machines stayed as they were.
Fixed is not patched
The National Audit Office investigated, and its verdict on the whole event was that it was "a relatively unsophisticated attack and could have been prevented by the NHS following basic IT security best practice." I think that is one of the most important security sentences I know, because of what it does not contain. No zero-day. No nation-state tradecraft. No failure of cleverness. Every ingredient of the NHS's worst digital day was public, dated, and delivered in advance.
We say a vulnerability "was fixed" as if fixing were one act. It is two jobs with two different owners. The vendor's job - find the flaw, write the update, ship it - was finished on March 14. Everything after that belonged to whoever actually ran the machines: know which ones you have, test the update against the ones that matter, schedule the restarts, chase the last stragglers. The first job takes a day and is done by people who do it for a living. The second takes weeks and belongs to an organization that has a hundred other things due that week. A worm attacks exactly the seam between the two. It moves at network speed while the fix waits on a testing window, a change review and someone's leave.
The NHS's own record shows what filled those 59 days. The Department of Health and the Cabinet Office had written to trusts back in 2014, saying it was essential they had "robust plans" to migrate off old software such as Windows XP by April 2015. Some trusts were still running XP in 2017, an operating system Microsoft no longer released patches for at all, so for those machines the March fix never existed to install. Every organization the worm infected, the NAO found, was running unpatched or unsupported Windows. And before May 12, the Department had no formal mechanism for checking whether anyone had acted on the patch alerts. The advice was real. Nobody was counting.
Then there is what it cost. The Department of Health and Social Care later estimated the bill at roughly 92 million pounds: about 19 million in lost care output and half a million of emergency IT support during the week, then roughly 72 million of IT support in the aftermath. NHS England counted 6,912 cancelled appointments in that first week and estimated the real total at 19,494. Patients in five areas had to travel further because their emergency departments could not treat them. The money bought nothing new - it paid for getting back what already worked on the Thursday before.
And one detail completes the picture for me. The kill switch stopped the locking on May 12, but the vulnerable machines were still there on May 13. NHS staff worked through the weekend of May 13 and 14 specifically to head off a fresh wave on Monday. The attack ended; the vulnerability did not. The worm stopped because a researcher flipped its off switch, not because anything had been patched.
What it means here
I run a small site, and I think about those 59 days every time it deploys. Every push to main crosses a pipeline that runs lint, typecheck, tests and a build, and the deploy does not ship while any of those are red. Dependencies install from a frozen lockfile, so nothing slips in unless the lockfile itself was updated and reviewed. None of this makes the software invulnerable. It collapses the distance between fixed and patched from an organizational project into an automated reflex, which is the form of the fix most likely to survive a busy week.
The honest part is what no pipeline can reach. The gap between "the update exists" and "the update is installed" never feels like a decision on the day you are in. The server is busy, the change might break something, the maintenance window is next week. Not one of those days is negligent on its own, and the worm still arrives on a random Friday and collects all of them at once. Automated attacks do not beat clever defenses. They beat calendars that drift.
So the question I would ask any site owner is not "is there a patch" but "how old is the oldest update you have not installed yet." On May 12, 2017, across the English health service, the answer started at 59 days.
Patch first - then claim your spot on the board at bidspotlight.com/submit.