Anatomy of a Breach

Anatomy of a Breach: 2017 Year in Review — The Year Cyber Went Nuclear

> series: anatomy_of_a_breach —— part: 108 —— year: 2017 —— verdict: the_year_cyber_went_nuclear<span class="cursor-blink">_</span>_

Hedgehog Security 31 December 2017 14 min read
data-breach year-in-review 2017 wannacry notpetya equifax eternalblue series
Breach #108

2017: WannaCry. NotPetya. Equifax. The year cyber went nuclear.

2017 was the year the theoretical became catastrophic. WannaCry brought the NHS to its knees — 80 trusts affected, 13,500 appointments cancelled, patients diverted from A&E. NotPetya caused over $10 billion in global damage — Maersk rebuilt its entire IT infrastructure from scratch; Merck's pharmaceutical production halted; FedEx, Reckitt Benckiser, and Mondelēz all suffered hundreds of millions in losses. Equifax lost 147 million Americans' Social Security numbers through a web framework that had not been patched for two months. And Uber's cover-up of a 57-million-record breach led to the first criminal conviction of a CSO for concealing a breach.

All three of 2017's landmark attacks — WannaCry, NotPetya, and the BadRabbit successor — were powered by leaked NSA exploits. The Shadow Brokers released EternalBlue in April; the CIA's tools were published via Vault 7 in March. The world's most capable intelligence agencies had lost control of their cyber weapons, and the consequences were measured in billions of dollars, thousands of cancelled medical appointments, and the permanent destruction of corporate infrastructure.

The Breaches
Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Twelve months. The most consequential year in cybersecurity history.

# Breach Key Lesson
097 MongoDB Ransomware 28,000+ databases with no passwords. Misconfiguration is the new vulnerability.
098 Cloudbleed Cloudflare leaked memory from millions of sites. Your security provider is your risk surface.
099 Vault 7 / CIA CIA's hacking tools published. iPhones, Android, smart TVs — everything hackable.
100 EternalBlue Released NSA's SMB exploit goes public. The patch was available. The fuse was lit.
101 WannaCry NHS: 80 trusts, 13,500 appointments. The patch was available for 59 days. Preventable.
102 NotPetya $10 billion damage. Disguised as ransomware. Designed for destruction. Supply chain weaponised.
103 UK Parliament 90 email accounts compromised through weak passwords. MFA was not mandatory.
104 HBO Hack Game of Thrones leaked. $6 million demanded. Content is extortion leverage.
105 Equifax 147 million SSNs. Apache Struts unpatched for 2 months. $700 million settlement.
106 Bad Rabbit + KRACK Ransomware returns. Wi-Fi breaks. Foundational protocols are not invulnerable.
107 Uber 57 million records. 13-month cover-up. CSO convicted. Concealment is criminal.
108 2017 Year in Review WannaCry. NotPetya. Equifax. The year cyber went nuclear. Everything predicted came true.
The Themes

What 2017 proved beyond any remaining doubt.

Patching Is the Single Most Important Control
WannaCry (59-day patch gap), Equifax (2-month patch gap), and Bad Rabbit (leveraged leaked NSA exploits) — all three of 2017's most devastating incidents were preventable through patching. <a href="/cyber-essentials">Cyber Essentials Danzell's</a> 14-day mandate is not bureaucracy — it is the control that separates survivors from victims.
Nation-State Weapons Cause Collateral Damage at Global Scale
NotPetya was aimed at Ukraine but destroyed $10 billion of multinational corporate infrastructure. WannaCry was attributed to North Korea but hit the NHS. When nation-state cyber weapons are deployed — or leaked — the damage is indiscriminate and global.
Healthcare Must Be Defended
WannaCry proved what eight years of this series had warned: NHS cybersecurity was critically inadequate, and the consequences were measured in cancelled appointments, diverted ambulances, and disrupted patient care. <a href="/blog/sector-under-the-microscope-healthcare">Healthcare security</a> is patient safety.
Covering Up Breaches Is Criminal
Uber's CSO was convicted for concealing a breach. The legal landscape has shifted permanently: disclosure is mandatory, and concealment carries personal criminal liability for executives. <a href="https://www.cyber-defence.io/services/incident-response">Incident response capability</a> must include regulatory disclosure procedures.
Nine Years Complete

108 articles. 2009 to 2017. The evidence is overwhelming. The conclusion is unchanged.

With 108 articles spanning nine years, this series has documented every major evolution of the cyber threat landscape — from lost CDs to nation-state cyber weapons, from SQL injection to supply chain attacks, from £1,000 ICO fines to $700 million settlements. The threats have scaled exponentially. The root causes have not changed. The controls remain the same. And the organisations that implement them — that test, certify, monitor, and prepare — survive. The rest fill these pages.

Nine Years of Evidence

108 breaches. Nine years. WannaCry, NotPetya, Equifax. The evidence is overwhelming. Act now.

<a href="/penetration-testing">Test</a>. <a href="/cyber-essentials">Certify</a>. <a href="https://www.socinabox.co.uk">Monitor</a>. <a href="https://www.cyber-defence.io">Prepare</a>. Because 2017 proved that cyber threats are not theoretical — they are existential.

Commission a Penetration Test Back to 2017 — Breach #097
Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call
Keep Reading

Related Articles

Anatomy of a Breach 31 December 2021

Anatomy of a Breach: 2021 Year in Review — Log4Shell, Colonial Pipeline, and the Year Ransomware Became a National Security Crisis

Breach #156 and the 2021 finale. The year Colonial Pipeline shut down America's fuel supply through a single compromised VPN password, the Irish HSE was devastated by Conti ransomware, JBS paid $11 million to REvil, Kaseya's supply chain attack hit 1,500 businesses, Hafnium compromised 250,000 Exchange servers, someone tried to poison Florida's water through TeamViewer, T-Mobile was breached for the fifth time, and — on 9 December — Log4Shell (CVE-2021-44228) was disclosed: a critical remote code execution vulnerability in Apache Log4j, a logging library embedded in hundreds of millions of systems worldwide. The vulnerability in everything.

data-breach year-in-review
16 min read
Anatomy of a Breach 31 December 2020

Anatomy of a Breach: 2020 Year in Review — SolarWinds, COVID-19, and the Year the Supply Chain Broke

Breach #144 and the 2020 finale. The year COVID-19 transformed the global attack surface overnight, SolarWinds rewrote the supply chain threat model, ransomware claimed its first life at Düsseldorf, Twitter proved social engineering trumps technology, Hackney Council was devastated for two years, Garmin paid $10 million, and the pandemic-fuelled explosion of remote working created new vulnerabilities faster than they could be secured. Then, on 13 December, the SolarWinds/Sunburst supply chain attack was discovered — compromising 18,000 organisations including US government agencies — the most sophisticated supply chain attack in history.

data-breach year-in-review
16 min read
Anatomy of a Breach 31 December 2019

Anatomy of a Breach: 2019 Year in Review — Ransomware Industrialised, Credentials Commoditised, and Travelex Hit on New Year's Eve

Breach #132 and the 2019 finale. The year 2.2 billion credentials were dumped in Collection #1-5, Norsk Hydro showed the world how to handle ransomware with dignity, Capital One lost 106 million records through a cloud misconfiguration, WhatsApp proved that zero-click phone exploitation is real, Baltimore proved EternalBlue is still unpatched two years on, and on New Year's Eve — literally the last hours of the decade — REvil ransomware struck Travelex, the UK foreign exchange company, beginning a crisis that would disrupt UK banking services into 2020.

data-breach year-in-review
14 min read
All Posts Get in Touch