Ransomware infections reported worldwide

A massive ransomware campaign appears to have infected a number of organisations around the world. Computers in thousands of locations have apparently been locked by a program that demands $300 (£230) in Bitcoin. There have been reports of infections in more than 70 countries, including the UK, US, China, Russia, Spain, Italy and Taiwan.

Many security researchers are linking the incidents together. The UK's National Health Service (NHS) was also hit by a ransomware outbreak on the same day and screenshots of the WannaCry program were shared by NHS staff.

One cyber-security researcher tweeted that he had detected many thousands of cases of the ransomware - known as WannaCry and variants of that name - around the world.

"This is huge," said Jakub Kroustek at Avast. Another, at cyber-security firm Kaspersky, said that the ransomware had been spotted cropping up in 74 countries and that the number was still growing.

There were a number of reports that Russia had seen more infections than any other single country. Russia's interior ministry said it had "localised the virus" following an "attack on personal computers using Windows operating system". It had reportedly earlier denied having been affected. Several experts monitoring the situation have linked the infections to vulnerabilities released by a group known as The Shadow Brokers, which recently claimed to have dumped hacking tools stolen from the US National Security Agency (NSA).

A patch for the vulnerability was released by Microsoft in March, but many systems may not have had the update installed.

Microsoft said on Friday its engineers had added detection and protection against WannaCrypt. The company was providing assistance to customers, it added.

Some security researchers have pointed out that the infections seem to be deployed via a worm - a program that spreads by itself between computers.

'Turn off PCs'

A number of Spanish firms were among the apparent victims elsewhere in Europe. Telecoms giant Telefonica said in a statement that it was aware of a "cybersecurity incident" but that clients and services had not been affected.

Power firm Iberdrola and utility provider Gas Natural were also reported to have suffered from the outbreak. There were reports that staff at the firms were told to turn off their computers. At least one local authority in Sweden also appears to have been a victim.

"We have around 70 computers that have had a dangerous code installed," the mayor of Timra, a town to the north of Stockholm, told the Reuters news agency.

Explaining the global ransomware outbreak

Unlike many other malicious programs, this one has the ability to move around a network by itself. Most others rely on humans to spread by tricking them into clicking on an attachment harbouring the attack code. By contrast, once WannaCry is inside an organisation it will hunt down vulnerable machines and infect them too. This perhaps explains why its impact is so public - because large numbers of machines at each victim organisation are being compromised.