12 ransomware examples: the attacks that changed how companies defend themselves

In brief: Ransomware is malware that locks an organisation’s files or systems and demands payment to release them. The twelve ransomware examples below run from WannaCry in 2017 to the attack on Dutch hospital software supplier ChipSoft in 2026, with five Dutch cases and one Belgian. The way in is usually ordinary: a phishing email, a guessable password, an account without multi-factor authentication, a help desk that resets a password for the wrong person. The ransom is rarely the real cost. The weeks of standstill and rebuilding are.

What ransomware is, and what these cases teach

For the definition and the variants, see what is ransomware. For a wider list of Dutch incidents, see the biggest cyber attacks in the Netherlands. Three things stand out across the twelve cases:

• Attackers log in more often than they break in. A password or a click is the usual first step.
• There is time between entry and encryption. Nine days at Change Healthcare, 69 at Maastricht University.
• Paying does not end it. The KNVB paid and still could not be sure its data was safe.

The 12 ransomware examples at a glance

The 12 ransomware examples in detail

1. WannaCry (2017): the worm that hit the NHS

What happened: On 12 May 2017 WannaCry spread through Windows systems that had not been updated. Europol counted more than 200,000 victims in at least 150 countries. In England at least 81 of 236 NHS trusts were affected, the National Audit Office found.

The lesson: No NHS organisation paid. The infected systems were unpatched or unsupported, so updating on time is still the cheapest defence.

2. NotPetya and Maersk (2017): 45,000 PCs in ten days

What happened: In June 2017 NotPetya arrived through a malicious update of Ukrainian accounting software. Shipping group Maersk was collateral damage and reinstalled 4,000 servers, 45,000 PCs and 2,500 applications in ten days, its chairman said. Cost: $250 to 300 million.

The lesson: The entry was a trusted update. Network segmentation and offline backups decide how long you are down.

3. Maastricht University (2019): 69 days from phishing mail to ransom note

What happened: On 15 and 16 October 2019 two phishing emails were opened on two workstations. On 23 December the Clop ransomware encrypted 267 Windows servers. The university paid 30 bitcoin, about €200,000. In 2022 police recovered part of it, by then worth around €500,000.

The lesson: The attackers were inside for 69 days. One reported email in that period could have changed the outcome.

4. Hof van Twente (2020): Welkom2020

What happened: The administrator password of this Dutch municipality was “Welkom2020”, and a firewall change in November 2020 opened the server to the internet. Attackers destroyed the backups. The municipality did not pay; recovery cost about €4 million.

The lesson: A court later held the municipality itself responsible. A guessable password without a usable backup is the most expensive combination.

5. Colonial Pipeline (2021): one old VPN account

What happened: On 7 May 2021 the DarkSide group got into the US fuel pipeline operator through an old VPN account with an exposed password and no multi-factor authentication. Colonial shut its pipeline down for several days and paid $4.4 million. The US Department of Justice recovered $2.3 million.

The lesson: The account was not supposed to be in use. Remove old accounts and require MFA on every remote login.

6. Kaseya (2021): one supplier, up to 1,500 victims

What happened: On 2 July 2021 the REvil group exploited a flaw in Kaseya’s VSA software, which IT service providers use to manage their customers’ systems. Through those providers the ransomware reached 800 to 1,500 businesses. REvil demanded $70 million.

The lesson: Dutch researchers at DIVD had already reported the flaws to Kaseya. Know which suppliers have administrator access to your systems.

7. VDL Groep (2021): 105 companies at a standstill

What happened: In October 2021 an attack hit Dutch industrial group VDL and its 105 companies, including car factory NedCar. It took more than a month before every unit was producing again. Police linked the attack to Conti malware; a suspect was arrested in Kyiv in 2024.

The lesson: VDL never said whether it paid. For a manufacturer the cost is in the standstill, so rehearse it.

8. City of Antwerp (2022): up to €70 million

What happened: In the night of 5 to 6 December 2022 the Play group hit the City of Antwerp and stole more than 500 GB of data. The city says it never paid. The council estimated the cost at up to €70 million.

The lesson: The Flemish supervisory commission found missing security updates, too little two-factor authentication and poor network segmentation. The basics were the gap.

9. KNVB (2023): paying without peace of mind

What happened: In April 2023 the LockBit group stole personal data from the Dutch football association KNVB, reportedly after an employee fell for a phishing email. According to RTL Nieuws the demand was more than €1 million. In September the KNVB confirmed that it had paid, without naming the amount.

The lesson: The association said it could not be sure the data would stay private. A payment buys a promise from criminals.

10. Change Healthcare (2024): no MFA on one portal

What happened: On 12 February 2024 attackers logged in to a remote access portal of US healthcare payment processor Change Healthcare with stolen credentials. The portal had no multi-factor authentication. Nine days later the ALPHV/BlackCat ransomware was deployed. Parent company UnitedHealth confirmed a ransom payment and reported $872 million in costs for the first quarter.

The lesson: One missing control was enough. Data of 192.7 million people was affected.

11. Marks & Spencer (2025): a password reset for the wrong person

What happened: On 17 April 2025 attackers impersonated someone who worked with M&S and got a third party to reset a password, chairman Archie Norman told MPs. The DragonForce ransomware followed. Online orders stopped for weeks and half-year profit fell from £391.1 million to £3.4 million.

The lesson: No technical flaw was needed. A help desk needs a verification step that a convincing caller cannot talk past.

12. ChipSoft (2026): ransomware at the supplier of hospital records

What happened: On 7 April 2026 healthcare security centre Z-CERT confirmed a ransomware attack on ChipSoft, which supplies patient record software to most Dutch hospitals. Eleven hospitals took ChipSoft software offline. Patient data of a substantial number of care providers was stolen; ChipSoft said later that publication had been prevented.

The lesson: The hospitals themselves were not the target, and their services were still disrupted. Plan for working without a critical supplier.

How a ransomware attack unfolds

The cases follow the same five steps. Our article on the stages of a cyber attack describes them in more depth.

1. Initial access. A phishing email, a stolen or guessed password, or a system that was not updated.
2. Lateral movement. The attackers explore the network and collect more rights, often for days or weeks.
3. Exfiltration. They copy data out of the organisation.
4. Encryption. Files, servers and backups are locked, often at night or around a holiday.
5. Double extortion. Pay for the key, and pay again to keep the stolen data offline. In 2025 the Nova group stole screening data of about 715,000 women from Dutch lab Clinical Diagnostics and demanded €1.1 million.

Ransomware families and ransomware-as-a-service

Clop, Conti, DarkSide, REvil, LockBit, ALPHV/BlackCat, Play, DragonForce: the names in these cases are brands more than fixed teams. In the ransomware-as-a-service model, developers rent out the software and affiliates carry out the attack for a share of the ransom. In the Netherlands and Belgium, LockBit has published the most victims since 2020, while Qilin was the most active group in the past year, according to the Cyber Dreigingsradar 2026.

What the 12 cases have in common

• An ordinary way in. Phishing at Maastricht, a weak password in Hof van Twente, no MFA at Colonial and Change Healthcare, a help desk at M&S.
• Suppliers as a route. Kaseya, ChipSoft and the software update behind NotPetya hit customers who did nothing wrong themselves.
• Standstill costs more than ransom. Maersk, VDL, Antwerp and M&S show it.

What employees can do against ransomware

In at least half of the twelve cases, the first step ran through a person or a password. That makes four habits worth more than most tools:

• Report a suspicious email or a wrong click immediately. Speed matters more than blame. Our overview of types of phishing attacks shows what to look for.
• Use a unique password and MFA on every work account.
• Verify requests for a password reset or remote access, also when the caller sounds like IT.
• Install updates when asked.

The technical side, from backups to segmentation, is covered in how to prevent ransomware. Which organisations run the most risk is explained in risk factors for ransomware attacks.

Frequently asked questions

What is an example of a ransomware attack?

WannaCry in 2017, which hit more than 200,000 victims in at least 150 countries. A Dutch example is Maastricht University, which paid 30 bitcoin in 2019 after 267 servers were encrypted.

What are well-known ransomware examples in the Netherlands?

Maastricht University (2019), the municipality of Hof van Twente (2020), VDL Groep (2021), the KNVB (2023) and ChipSoft (2026). In Belgium the attack on the City of Antwerp (2022) is the best documented.

How do most ransomware attacks start?

With a phishing email, a stolen or weak password on an account without multi-factor authentication, or a system that was not updated.

Should you pay the ransom?

The cases show both routes. Maastricht University and the KNVB paid; Hof van Twente and Antwerp did not and rebuilt. Paying gives no guarantee that data is deleted, and it finances the next attack.