A massive attack is spreading globally by way of a vulnerability in Microsoft 's Server Message Block that was patched Vulnerability-related.PatchVulnerability in March . Ransomware is no longer just a nuisance . Now it 's quite literally a matter of life and death . A massive ransomware attack Attack.Ransom being labeled as `` WannaCry Attack.Ransom `` has been reported around the world and is responsible for shutting down hospitals in the United Kingdom and encrypting files at Spanish telecom firm Telefonica . The WannaCry attack Attack.Ransom is not a zero-day flaw , but rather is based on an exploit that Microsoft patched Vulnerability-related.PatchVulnerability with its MS17-010 advisory on March 14 in the SMB Server . However , Microsoft did not highlight Vulnerability-related.DiscoverVulnerability the SMB flaw until April 14 , when a hacker group known as the Shadow Brokers released Vulnerability-related.DiscoverVulnerability a set of exploits , allegedly stolen Attack.Databreach from the U.S.National Security Agency . SMB , or Server Message Block , is a critical protocol used by Windows to enable file and folder sharing . It 's also the protocol that today 's WannaCry attack Attack.Ransom is exploiting to rapidly spread from one host to the next around the world , literally at the speed of light . The attack is what is known as a worm , `` slithering '' from one host to the next on connected networks . Among the first large organizations to be impacted by WannaCry is The National Health Service in the UK , which has publicly confirmed that it was attacked Attack.Ransom by the Wan na Decryptor. `` This attack Attack.Ransom was not specifically targeted at the NHS and is affecting organisations from across a range of sectors , '' the NHS stated . `` At this stage we do not have any evidence that patient data has been accessed Attack.Databreach . '' Security firm Kaspersky Lab reported that by 2:30 p.m . ET May 12 it had already seen more than 45,000 WannaCry attacks Attack.Ransom in 74 countries . While the ransomware attack Attack.Ransom is making use of the SMB vulnerability to spread , the encryption of files is done by the Wanna Decryptor attack Attack.Ransom that seeks out all files on a victim 's network . Once the ransomware has completed encrypting files , victims are presented with a screen demanding a ransom Attack.Ransom . Initially , the ransom requested Attack.Ransom was reported to be $ 300 worth of Bitcoin , according to Kaspersky Lab . `` Many of your documents , photos , videos , databases and other files are no longer accessible because they have been encrypted , '' the ransom note states . `` Maybe you are busy looking for a way to recover your files , but do not waste your time . Nobody can recover your files without our decryption service . '' It 's not clear who the original source of the global WannaCry attacks Attack.Ransom is at this point , or even if it 's a single threat actor or multiple actors . What is clear is that despite the fact that a software patch has been available Vulnerability-related.PatchVulnerability since March for the SMB flaws , WannaCry is using tens of thousands of organizations that did n't patch Vulnerability-related.PatchVulnerability .

Federal officials , Microsoft and Cisco are working with the city of Atlanta to resolve the attack Attack.Ransom , but Atlanta 's mayor wo n't say if the city paid Attack.Ransom the $ 51,000 ransom Attack.Ransom . As of Saturday , Atlanta officials and federal partners were still “ working around the clock ” to resolve the ransomware attack Attack.Ransom on city computers that occurred around 5 a.m. on Thursday , March 22 , and encrypted some financial and person data . As @ Cityofatlanta officials & federal partners continue working around the clock to resolve issues related to the ransomware cyber attack Attack.Ransom launched against the City , solid waste & other DPW operations are not impacted . — ATLPublicWorks ( @ ATLPublicWorks ) March 24 , 2018 On Thursday , the official investigation included “ the FBI , U.S. Department of Homeland Security , Cisco cybersecurity officials and Microsoft to determine what information has been accessed Attack.Databreach and how to resolve the situation. ” A city employee sent WXIA a screenshot of the ransom demand Attack.Ransom , which included a pay-per-computer option Attack.Ransom of $ 6,800 or an option to pay Attack.Ransom $ 51,000 to unlock the entire system . CBS 46 reported that the ransom demand Attack.Ransom and instruction said : Send .8 bitcoins for each computer or 6 bitcoins for all of the computers . ( That 's the equivalent of around $ 51,000 . ) After the .8 bitcoin is sent , leave a comment on their website with the provided host name . They ’ ll then reply to the comment with a decryption software . When you run that , all of the encrypted files will be recovered . On Friday , March 23 , city employees were handed a printed notice as they walked through the front doors . They were told not to turn on their computers until the issue was resolved . Officials were still unsure who was behind the attack . Mayor Keisha Lance Bottoms advised city employees and customers to monitor their personal information , although there was no evidence to show customer or employee data was compromised Attack.Databreach . Mayor Bottoms clarified what services had not been impacted and were still available to residents and which ones had been impacted . Mayor Bottoms will not say if Atlanta intends to pay the ransom demand Attack.Ransom , saying , “ We will be looking for guidance from , specifically , our federal partners on how to best navigate the best course of action. ” During a press conference , Bottoms said , “ What we want to make sure of is that we aren ’ t putting a Band-Aid on a gaping wound. ” She then turned the press conference over to Richard Cox , the City of Atlanta 's chief operations officer ; the poor dude is brand new to serving as Atlanta ’ s COO . He confirmed the existence of the ransom demand Attack.Ransom but would not reveal the contents .