Businesses that failed to update Windows-based computer systems that were hit by a massive cyber attack over the weekend could be sued over their lax cyber security , but Microsoft itself enjoys strong protection from lawsuits , legal experts said . The WannaCry worm has affected more than 200,000 Windows computers around the world since Friday , disrupting Attack.Ransom car factories , global shipper FedEx Corp and Britain 's National Health Service , among others . The hacking tool spreads silently between computers , shutting them down by encrypting data and then demanding a ransom Attack.Ransom of US $ 300 to unlock them . According to Microsoft , computers affected by the ransomware did not have security patches for various Windows versions installed or were running Windows XP , which the company no longer supports . `` Using outdated versions of Windows that are no longer supported raises a lot of questions , '' said Christopher Dore , a lawyer specializing in digital privacy law at Edelson PC . `` It would arguably be knowingly negligent to let those systems stay in place. ” Businesses could face legal claims if they failed to deliver services because of the attack , said Edward McAndrew , a data privacy lawyer at Ballard Spahr . `` There is this stream of liability that flows from the ransomware attack Attack.Ransom , '' he said `` That 's liability to individuals , consumers and patients , '' WannaCry exploits Vulnerability-related.DiscoverVulnerability a vulnerability in older versions of Windows , including Windows 7 and Windows XP . Microsoft issued Vulnerability-related.PatchVulnerability a security update in March that stops WannaCry and other malware in Windows 7 . Over the weekend the company took the unusual step of releasing Vulnerability-related.PatchVulnerability a similar patch for Windows XP , which the company announced in 2014 it would no longer support . Dore said companies that faced disruptions because they did not run the Microsoft update or because they were using older versions of Windows could face lawsuits if they publicly touted their cyber security . His law firm sued LinkedIn after a 2012 data breach Attack.Databreach , alleging individuals paid for premium accounts because the company falsely stated it had top-quality cyber security measures . LinkedIn settled for US $ 1.25 million in 2014 . But Scott Vernick , a data security lawyer at Fox Rothschild that represents companies , said he was sceptical that WannaCry would produce a flood of consumer lawsuits . He noted there was no indication the cyber attack had resulted in widespread disclosure of personal data . `` It isn ’ t clear that there has been a harm to consumers , '' he said . Vernick said businesses that failed to update their software could face scrutiny from the US Federal Trade Commission , which has previously sued companies for misrepresenting their data privacy measures . Microsoft itself is unlikely to face legal trouble over the flaw in Windows being exploited Vulnerability-related.DiscoverVulnerability by WannaCry , according to legal experts . When Microsoft sells software it does so through a licensing agreement that states the company is not liable for any security breaches , said Michael Scott , a professor at Southwestern Law School . Courts have consistently upheld those agreements , he said . Alex Abdo , a staff attorney at the Knight First Amendment Institute at Columbia University , said Microsoft and other software companies have strategically settled lawsuits that could lead to court rulings weakening their licensing agreements . `` This area of law has been stunted in its growth , '' he said . `` It is very difficult to hold software manufacturers accountable for flaws in their products . '' Also enjoying strong protection from liability over the cyber attack is the US National Security Agency , whose stolen hacking tool is believed to be the basis for WannaCry . The NSA did not immediately return a request for comment . Jonathan Zittrain , a professor specializing in internet law at Harvard Law School , said courts have frequently dismissed lawsuits against the agency on the grounds they might result in the disclosure of top secret information . On top of that , the NSA would likely be able to claim that it is shielded from liability under the doctrine of sovereign immunity , which says that the government can not be sued over carrying out its official duties . `` I doubt there can be any liability that stems back to the NSA , '' Dore said .

A cybersecurity firm said that the recent WannaCry ransomware attacks Attack.Ransom may be connected to the group that orchestrated one of the biggest cyberheists in history that involved a Philippine bank . Kaspersky Lab , a cybersecurity and antivirus provider in Moscow , said in a statement that a security researcher at Google found an “ artifact ” on Twitter potentially linking the WannaCry ransomware attacks Attack.Ransom that hit Attack.Ransom organizations and individuals in several dozen countries and the Lazarus hacking group which was responsible for several devastating cyberattacks on government organizations , media firms and financial institutions in recent years . “ On Monday , May 15 , a security researcher from Google posted an artifact on Twitter potentially pointing at a connection between the WannaCry ransomware attacks Attack.Ransom that recently hit Attack.Ransom thousands of organizations and private users around the world , and the malware attributed to the infamous Lazarus hacking group , responsible for a series of devastating attacks against government organizations , media and financial institutions , ” Kaspersky said . Late last week , a worm dubbed WannaCry locked up more than 200,000 computers in more than 150 countries , disrupting Attack.Ransom operations of car factories , hospitals , shops , schools and other institutions . The attack on late Friday was slowed down after a security researcher took control of a server linked to the attack , crippling its ability to rapidly spread across the world . The Lazarus group meanwhile has been linked to several large-scale operations such as the attacks against Sony Pictures in 2014 and a series of similar attacks that continued until 2017 . One of the biggest attacks carried out by the Lazarus group was the Central Bank of Bangladesh heist in 2016 , one of the biggest in history . In that operation , hackers sent Attack.Phishing fraudulent messages that were made to appear to be Attack.Phishing from the Bangladeshi central bank to transfer $ 1 billion from its account in the Federal Reserve of New York . Most of the transfers were blocked but about $ 81 million was sent to RCBC in the Philippines . The money was moved around to make it difficult to trace . Kaspersky said that the Google researcher pointed at a WannaCry malware sample which appeared in February 2017 , weeks before the late Friday attack . Based on the analysis of Kaspersky researchers , it was confirmed that there was “ clear code similarities ” between the sample highlighted by the Google expert and the malware samples used by the Lazarus group in their 2015 attacks . Kaspersky however admitted that the similarities might be a false flag although another analysis of the February and WannaCry samples used in the recent operation showed that the code which could point at the Lazarus group was removed from the malware . Kasperksy said that this could be an attempt to cover the traces of the perpetrators of the WannaCry operations . “ Although this similarity alone does n't allow proof of a strong connection between the WannaCry ransomware and the Lazarus Group , it can potentially lead to new ones which would shed light on the WannaCry origin which to the moment remains a mystery , ” Kaspersky said .