NHS England

WannaCry did not expose a single forgotten patch so much as a distributed accountability system that could issue guidance, detect danger, and still fail to prove that local organisations had acted before patient care depended on it. The NHS England case matters because the outage translated cyber hygiene into cancelled appointments, diverted emergency care, paper workarounds, diagnostic delays, and a public bill for remediation. The practical question is who controlled the patching, unsupported systems, local trust autonomy, national guidance, incident response, and continuity choices that shaped the harm.