How did ransomware take hospitals and a fuel pipeline hostage?

Ransomware is malware that takes a victim's private data hostage until a ransom is paid. It can lock files with encryption, steal them and threaten to publish them, or both. The ransom is usually demanded in cryptocurrency, which is harder to trace, and that is part of why the crime is hard to prosecute.

The idea is old. The first known case of malware extortion, the "AIDS Trojan" of 1989, was so badly designed that its decryption key could be extracted from the trojan itself, so paying was unnecessary. Modern versions use public-key cryptography, so only the attacker holds the key that unlocks the files.

In May 2017 WannaCry made the idea global. It spread on its own, as a worm, using an exploit called EternalBlue that the NSA had developed for Windows and that a group called The Shadow Brokers had stolen and leaked a month before. Microsoft had already released patches, but many organizations had not applied them. More than 300,000 computers in 150 countries were affected, including NHS hospitals in the UK, where some services turned away non-critical emergencies and some ambulances were diverted. The attack was halted within hours by the registration of a "kill switch" discovered by researcher Marcus Hutchins.

In May 2021 the target was the Colonial Pipeline, which carries about 45 percent of the East Coast's fuel. The attackers got in with a compromised password for an inactive VPN account that had no multi-factor authentication. The company halted the whole pipeline and, according to reports, paid about $4.4 million in bitcoin. Experts later said such attacks were preventable with measures that were not in place.