It is now possible to compromise a handful of computer systems and bring a production line to a halt, disrupt payments across a healthcare system or interfere with the energy supply of millions of people. What once belonged to the realm of catastrophic scenarios has become a recurring reality in some of the world's most developed economies. Cyberattacks do not necessarily destroy physical infrastructure. They can simply render it unusable by removing the information, authorisations or digital services required for its operation.

This transformation marks a fundamental shift in the nature of technological risk. For several decades, digitalisation was regarded primarily as a means of increasing productivity, improving coordination and reducing costs. Companies integrated their operations, governments centralised their data, banks automated their transactions and industries connected their equipment. The efficiency gains have been considerable. Yet every new interconnection has also multiplied the potential pathways through which a failure can spread.

From the global WannaCry and NotPetya attacks in 2017 to the operations targeting telecommunications, healthcare infrastructure, automotive manufacturers and financial platforms during the 2020s, a common pattern has emerged. Digital power is no longer merely a productive capability. It has also become a source of strategic exposure.

The central question is therefore not simply how many companies have been hacked or how much data has been stolen. It is how a localised vulnerability can now produce disproportionate economic and political consequences, sometimes thousands of kilometres from its point of origin.

2017: When Cyberattacks Crossed Borders

The year 2017 marked a turning point in the modern history of cybersecurity. Two distinct operations, WannaCry and NotPetya, demonstrated within weeks of each other that malicious software could spread rapidly across organisations and territories, disregarding economic and political boundaries.

In May, WannaCry exploited a Windows vulnerability to propagate automatically between inadequately protected computers. Hundreds of thousands of machines were affected worldwide. Victims included companies, government agencies and healthcare institutions, particularly in the United Kingdom, where the National Health Service experienced major disruptions.

Appointments were cancelled, some systems became unavailable and healthcare professionals were temporarily forced to return to manual procedures. The crisis revealed that a hospital depends not only on its medical equipment and personnel, but also on continuous access to records, communication systems and administrative applications.

WannaCry belonged to the category of ransomware, malicious software that makes data or systems inaccessible in exchange for payment. Its significance, however, extended far beyond conventional extortion. Its automated propagation transformed a software vulnerability into an international crisis.

A few weeks later, NotPetya caused even greater economic damage.

The attack initially emerged in Ukraine, notably through the compromise of an accounting software package widely used in the country. It subsequently spread into the networks of multinational corporations operating across several continents. Shipping company Maersk, pharmaceutical group Merck and FedEx's TNT Express operations were among the organisations severely affected.

Unlike conventional ransomware, NotPetya was not primarily designed as a financial bargaining instrument. Its operation made data recovery extremely difficult, if not impossible. The malware was essentially destructive.

Frequently cited estimates place the worldwide economic damage above $10 billion, although this aggregate figure remains an estimate rather than a universally established accounting total.

NotPetya's historical importance lies in its transmission mechanism. An operation initially concentrated within Ukraine's digital environment caused major disruptions to international shipping, pharmaceuticals, logistics and manufacturing.

Productive globalisation had created the conditions for its own digital contagion. Multinational corporations had built integrated networks to coordinate their subsidiaries. Those same networks allowed an attack to move rapidly beyond its initial perimeter.

The American and British authorities publicly attributed NotPetya to Russia, an attribution rejected by Moscow. The episode thus illustrated another characteristic of cyberspace: an operation associated with a geopolitical conflict can impose substantial costs on economic actors that are not directly involved in that conflict.

Espionage at a New Scale: From SolarWinds to Telecommunications

Destruction, however, represents only one dimension of cyber risk. Some of the most strategically significant operations are designed to remain invisible.

Discovered in 2020, the SolarWinds affair exposed a particularly sophisticated intrusion into the software supply chain. Attackers compromised the distribution mechanism for updates to Orion, software used to administer and monitor computer networks.

The principle was formidable: rather than attacking each organisation separately, the perpetrators exploited the trust placed in a technology supplier. An update regarded as legitimate became the vehicle for intrusion.

Approximately 18,000 customers received a compromised version of the software, but this does not mean that all experienced active exploitation. The attackers subsequently selected a much smaller number of targets for intelligence operations.

Several American government agencies were affected. Washington officially attributed the campaign to Russia's Foreign Intelligence Service, the SVR.

The operation exposed a profound weakness in modern digital architectures. Organisations can invest heavily in their own security while remaining vulnerable to a compromise originating from a provider to which they have granted extensive technical privileges.

This vulnerability is not confined to software. It extends to cloud providers, identity management services, telecommunications operators and companies responsible for maintaining IT infrastructure.

Operations attributed to the group known as Salt Typhoon illustrate this development.

Beginning in 2024, American authorities disclosed compromises affecting several telecommunications companies. The FBI described a campaign associated with actors linked to the People's Republic of China, involving access to call records, certain private communications and information relating to lawful interception requests.

The objective was no longer simply to steal documents stored within a government agency. It was to obtain a privileged position inside the networks carrying society's communications.

This distinction is fundamental. A compromised database provides access to a defined collection of information. A compromised telecommunications network can offer opportunities for collection, observation and intelligence gathering over time, depending on the privileges obtained.

Telecommunications have therefore become an infrastructure of sovereignty, just as energy, transportation and financial systems have.

Digital confrontation between major powers is no longer limited to obtaining classified military information. It also concerns the civilian infrastructure on which institutions, businesses and public officials depend.

Energy: The Fragility of Essential Infrastructure

In May 2021, a ransomware attack struck Colonial Pipeline, the operator of a major fuel transportation network in the United States.

The company temporarily suspended operations to contain the incident and assess its consequences. The decision generated supply pressures in several states along the American East Coast, amplified by precautionary purchases and logistical difficulties.

An important distinction must be made: the attack did not mean that hackers had directly seized physical control of the pipeline's transportation equipment. The compromise concerned the company's information systems, while the pipeline shutdown resulted from an operational security decision.

Yet this distinction does not diminish the event's significance. It makes it more revealing.

Physical infrastructure can be immobilised without its industrial equipment being destroyed or directly manipulated. It is enough for the systems required for its operation, billing, supervision or management to become unavailable or insufficiently trustworthy.

The attack on Colonial Pipeline, attributed to the criminal group DarkSide, demonstrated that energy security can no longer be understood exclusively through production capacity, strategic reserves and distribution networks.

It also depends on the resilience of the digital systems that allow these infrastructures to operate.

The same reasoning applies to electricity grids, ports, refineries, liquefied natural gas terminals and railway systems.

The more automated and interconnected an infrastructure becomes, the more its operational continuity requires rigorous separation between administrative networks, industrial control systems and external access points.

This dependence does not mean that every cyberattack can trigger a physical catastrophe. Industrial systems often possess specific protections, safety mechanisms and degraded operating modes. But it expands the range of risks that critical infrastructure operators must anticipate.

Protecting infrastructure is no longer simply a matter of preventing its destruction. It also means ensuring that it can continue delivering essential services even when part of its digital environment has been compromised.

Healthcare: When Digital Failure Becomes a Human Risk

Cyberattacks against healthcare systems reveal a different kind of vulnerability.

In February 2024, Change Healthcare, a company owned by UnitedHealth Group, suffered a ransomware attack that profoundly disrupted the processing of medical transactions across the United States.

Change Healthcare occupies a central position in administrative and financial exchanges between insurers, healthcare facilities, pharmacies and other providers.

The incident interrupted claims processing and payments. Healthcare professionals encountered cash-flow difficulties, while certain administrative operations had to be reorganised.

The attack therefore reached far beyond the directly compromised company. It affected an entire ecosystem of providers dependent on the same digital intermediary.

The data dimension was equally exceptional. According to information reported to American health authorities, approximately 192.7 million people were affected by the data breach.

This figure illustrates the extraordinary concentration of sensitive information within certain service infrastructures.

A few months later, in the United Kingdom, an attack against Synnovis, a pathology services provider for several NHS institutions in London, disrupted laboratory testing and led to the postponement of numerous procedures and appointments.

These incidents do not establish that every individual medical consequence can automatically be attributed to the cyberattack. They nevertheless demonstrate that an IT disruption can directly affect the organisation of healthcare and the timing of treatment.

Healthcare has a particular characteristic: continuity of service carries a value that cannot be fully expressed in financial terms.

An industrial company can calculate the cost of a lost day of production. A hospital must also assess the consequences of a delayed examination, a postponed operation or temporarily inaccessible clinical information.

Healthcare cybersecurity is therefore becoming an integral component of patient safety.

This development requires medical information systems to be regarded not merely as administrative functions, but as critical infrastructure whose availability determines part of the actual capacity to deliver care.

Industry: Production Suspended by Digital Systems

Modern industry relies on growing integration between machinery, software, suppliers and planning systems.

Automotive manufacturing offers a particularly clear illustration. Producing a vehicle requires the coordination of thousands of components, orders, specifications, industrial programmes and logistical operations.

This organisation delivers substantial productivity gains. It reduces inventories, synchronises suppliers and improves the utilisation of industrial capacity. But it can also amplify the consequences of an IT interruption.

The cyberattack suffered by Jaguar Land Rover in 2025 provides a major example.

Following the incident, the British manufacturer suspended production for several weeks. The consequences extended beyond its factories, affecting numerous suppliers, subcontractors and distributors.

The United Kingdom's Cyber Monitoring Centre estimated the event's economic impact at approximately £1.9 billion, within a range of £1.6 billion to £2.1 billion. This figure is based on economic modelling and should not be confused with a definitively audited loss.

The organisation also estimated that more than 5,000 British organisations were directly or indirectly affected.

The incident exposed an often underestimated dimension of cyberattacks: their economic propagation can be considerably wider than their technical propagation.

A supplier does not need to be hacked to suffer losses. Its principal customer merely has to suspend orders. A dealership can encounter difficulties without its own computer network being compromised. A transport company can lose business because a factory is no longer producing.

Digital risk is then transmitted through commercial relationships, contracts and industrial interdependencies.

This propagation challenges certain principles of risk management. A company may possess a robust IT architecture while remaining heavily exposed to cyberattacks suffered by its customers, suppliers or essential service providers.

Industrial resilience therefore no longer depends exclusively on internal security. It depends on the capacity of the entire value chain to absorb a major interruption.

States Confront Administrative Paralysis

Public administrations are particularly sensitive targets because they concentrate functions whose interruption directly affects the population.

In 2022, Costa Rica suffered a series of cyberattacks targeting several public institutions, including agencies responsible for public finances and essential services.

Operations associated with the criminal group Conti caused major disruptions and prompted the authorities to declare a national state of emergency.

The episode demonstrated that a cyberattack can become a governmental crisis without necessarily targeting any military installation.

When tax, customs or administrative systems cease functioning normally, the consequences can affect public revenues, international trade and relations between the state and its citizens.

Countries with limited technical resources or ageing IT systems may be particularly vulnerable, especially when public administrations depend on heterogeneous infrastructures that are inadequately updated or difficult to restore.

Yet wealth provides no guarantee of protection. Advanced economies possess greater defensive capabilities while operating more numerous and interconnected systems.

The challenge is therefore twofold. States must protect their own networks while organising the continuity of public functions in the event of a major incident.

This necessity is progressively transforming cybersecurity into a matter of national governance.

It requires coordination between government agencies, security authorities, private operators, sectoral regulators and crisis-management institutions.

Digital Finance: From Data Theft to the Direct Transfer of Wealth

Attacks targeting financial systems have undergone a particular evolution.

In traditional banking, cybercriminals may seek to divert payments, compromise credentials or obtain information enabling subsequent fraud. Clearing, compliance and control mechanisms nevertheless provide different levels of verification and, in some cases, opportunities to block or recover funds.

The digital asset ecosystem introduces different characteristics. Transactions validated on certain blockchains can be difficult to reverse, while exchanges and custody mechanisms concentrate considerable amounts of value.

In March 2022, an attack against Ronin Network, an infrastructure associated with the Axie Infinity gaming ecosystem, resulted in the theft of digital assets valued at approximately $625 million at the time of the incident.

In February 2025, the Bybit platform suffered an operation of even greater magnitude. Approximately $1.5 billion in digital assets was stolen.

The FBI officially attributed the attack to North Korean actors as part of activity it identifies under the name TraderTraitor.

These operations illustrate the transformation of cybercrime into a potential instrument of strategic financing.

When authorities attribute large-scale digital asset theft to groups linked to a state, the distinction between financial crime, sanctions evasion and state power becomes particularly important.

However, the different levels of attribution must not be confused. Identifying a criminal infrastructure, associating a group with an intelligence service and demonstrating the ultimate use of stolen funds are separate questions.

The difficulty concerns not only preventing theft, but also tracing assets, monitoring their conversion and movement between platforms, and securing the international cooperation needed to freeze them.

Digital finance thus reveals a paradox. Distributed ledgers can make transactions publicly traceable without guaranteeing the immediate identification of beneficiaries or the effective recovery of funds.

Technical transparency does not amount to institutional control.

Ransomware: An Organised Criminal Economy

The expansion of cyberattacks has been accompanied by a transformation in their economic organisation.

Ransomware is no longer necessarily developed and deployed by small groups operating in isolation. Part of this ecosystem functions through specialised business models, sometimes described as ransomware-as-a-service.

Some actors develop malicious software, others obtain initial access to networks, while affiliates conduct intrusions and negotiate extortion payments.

This specialisation allows tools, infrastructure and expertise to be shared. It lowers entry barriers for some criminals and facilitates the multiplication of campaigns.

Extortion itself has evolved.

Data encryption, long central to the model, is now frequently accompanied by exfiltration. Attackers threaten to publish confidential information, disclose personal data or expose trade secrets.

A company with functioning backups may therefore remain vulnerable to financial pressure based on confidentiality rather than system availability.

The economic consequences become difficult to measure. They include investigation expenses, restoration costs, business interruptions, commercial losses, legal fees, potential regulatory penalties and reputational damage.

Ransom payments often represent only a fraction of the total cost.

Payment does not guarantee the complete recovery of data or prevent subsequent disclosure. It may also expose victims to legal restrictions, particularly when beneficiaries are subject to sanctions.

Combating these networks consequently requires more than technical solutions. It involves financial intelligence, police cooperation, asset-freezing mechanisms and cross-border judicial procedures.

The Geopolitics of a Space Without Operational Borders

Cyberspace possesses a characteristic that profoundly complicates international relations: technical infrastructure crosses jurisdictions, while policing powers and political responsibilities remain largely national.

A company may be registered in one country, host its data in another, use services provided by a supplier established in a third and suffer an attack conducted through infrastructure distributed across several continents.

Perpetrators can conceal their origins by exploiting compromised servers, anonymisation networks or technical intermediaries.

Attribution therefore becomes a complex process combining computer forensics, intelligence, financial investigations and sometimes classified information.

It is essential to distinguish technical attribution from political accusation. The former identifies tools, methods or infrastructure; the latter may assign responsibility to organisations or states. Their strength depends on the available evidence, some of which is not always publicly disclosed.

Cyberoperations attributed to Russia, China, North Korea and other state or state-linked actors do not necessarily pursue the same objectives.

Some seek intelligence. Others aim to disrupt adversaries' capabilities, exert political pressure or obtain financial resources.

Independent criminal operations follow different logics, although overlaps may exist between criminal networks, host territories and state interests.

This diversity makes it misleading to interpret every cyberattack as part of a single global confrontation.

It nevertheless highlights a common development: digital systems have become both instruments and targets of power.

A state's sovereignty is no longer measured solely by its ability to control its territory, borders or resources. It also depends on its command of essential digital infrastructure and its ability to continue functioning when that infrastructure is disrupted.

Technological Concentration: A New Source of Systemic Risk

One of the most important lessons of the past decade concerns the concentration of digital dependencies.

Companies have progressively outsourced part of their infrastructure to specialised providers. This development provides access to more advanced technologies, reduces certain costs and offers security capabilities that would be difficult to reproduce individually.

But it can also concentrate the consequences of an incident.

When a single provider performs an essential function for thousands of organisations, its compromise or unavailability can become a systemic event.

SolarWinds demonstrated this in network administration software. Change Healthcare illustrated it in healthcare transactions. Attacks exploiting file-transfer providers such as MOVEit showed how a common vulnerability could lead to data compromises across a large number of organisations.

This does not mean that centralisation is inherently less secure than fragmentation.

A specialised provider may possess expertise, monitoring resources and response capabilities superior to those of its customers. Shared infrastructure can therefore improve average security.

The problem arises when individual protection gains are accompanied by excessive concentration of collective risk.

An infrastructure can be exceptionally well protected and still be sufficiently important for its eventual failure to produce disproportionate consequences.

This logic increasingly resembles certain systemic financial risks.

In both cases, interdependencies can transmit an initial shock to organisations that bear no direct responsibility for its origin.

Mapping dependencies is therefore becoming as important as identifying technical vulnerabilities.

Artificial Intelligence and the Next Transformation of Risk

The rise of artificial intelligence adds another dimension to this environment.

Generative models can facilitate certain malicious activities, including the production of convincing fraudulent messages, the linguistic adaptation of phishing attempts and the automation of preparatory tasks.

They can also contribute to software analysis, vulnerability research and the organisation of complex operations, depending on available capabilities and safeguards.

It would nevertheless be excessive to claim that artificial intelligence has already replaced human operators in the autonomous execution of the most sophisticated cyberattacks.

Major operations generally continue to rely on combinations of technical vulnerabilities, configuration errors, compromised credentials, social engineering and detailed knowledge of targeted environments.

AI primarily changes the economic conditions of certain activities. It can reduce preparation time, increase the personalisation of fraudulent attempts and facilitate the processing of large quantities of information.

Defenders can benefit from it as well.

Detection systems can use machine learning to identify unusual behaviour, connect weak signals and accelerate incident analysis.

The central question is therefore not whether artificial intelligence will exclusively favour attackers or defenders. It is how it will change their respective capabilities and the speed at which vulnerabilities can be exploited or corrected.

Another challenge emerges as AI systems become integrated into operational processes. When a software assistant can consult documents, interact with applications or initiate actions, permission management and the reliability of the information it receives become essential security concerns.

Automation creates new productivity gains, but it also introduces new control requirements.

Why the True Costs Remain Difficult to Measure

International rankings of cyberattacks often rely on heterogeneous criteria.

An attack may be considered major because it compromised millions of personal records, while another stands out because of its financial cost or the consequences of interrupting an essential service.

These dimensions are not directly comparable.

The theft of 100 million records does not necessarily produce greater economic damage than the shutdown of a factory for several weeks. Conversely, an attack causing limited financial losses may have considerable strategic consequences when it involves government communications or military infrastructure.

Financial estimates must also be interpreted carefully.

Some correspond to losses directly reported by companies. Others derive from economic models incorporating consequences for suppliers, customers and indirectly affected activities.

Both approaches are useful, but they do not measure the same thing.

It is also necessary to account for incidents that are never publicly disclosed, those whose consequences are underestimated and espionage operations discovered years after they began.

Statistical visibility therefore remains imperfect.

A serious analysis of cyberattacks should distinguish at least four dimensions: the technical extent of the compromise, economic losses, effects on essential services and strategic consequences.

This approach avoids reducing a multidimensional phenomenon to a sensational ranking based on a single figure.

Resilience Becomes a Competitive Imperative

In response to these developments, cybersecurity policies have progressively moved beyond the logic of perimeter protection.

The objective is no longer simply to prevent intrusion. It is also to limit an attacker's privileges after access has been obtained, detect their presence rapidly, contain their movement and restore essential functions.

This approach requires stronger authentication mechanisms, network segmentation, isolated backups, business-continuity plans and crisis-management exercises.

It also demands precise knowledge of external dependencies.

An organisation must be able to identify the suppliers whose unavailability would interrupt its activities, the systems that cannot be restored quickly and the operations that must temporarily continue without their usual digital tools.

Cybersecurity therefore becomes a matter of corporate governance.

Executive management and boards of directors can no longer regard it solely as a responsibility delegated to IT teams. The relevant decisions concern investment, operational organisation, supplier contracts, insurance and business continuity.

For states, the challenge is comparable.

Protecting critical infrastructure requires proportionate obligations, incident-reporting mechanisms, cooperation between authorities and operators, and national response capabilities.

The European Union has strengthened this framework through the NIS2 Directive and the Digital Operational Resilience Act, or DORA, which addresses digital operational resilience in the financial sector.

These instruments reflect an institutional evolution: cybersecurity is no longer approached merely as the protection of individual systems, but as a condition for the stability of entire economic sectors.

Digital resilience is progressively becoming a factor of competitiveness, alongside energy security, infrastructure quality and financial stability.

The Paradox of Technologically Advanced Societies

The cyberattacks of recent years expose a fundamental contradiction in contemporary development.

Advanced economies have built their strength on the rapid circulation of information, the automation of operations and the integration of infrastructure.

These characteristics provide considerable advantages. They make it possible to organise global value chains, coordinate millions of transactions and manage industrial systems of previously unimaginable complexity.

But they also make economic functions dependent on digital continuity that can never be guaranteed absolutely.

A less digitalised society may be less exposed to certain forms of cyberattack without necessarily being more productive, secure or resilient overall. Conversely, a highly digitalised society may possess excellent defences while concentrating more potential consequences within a handful of infrastructures.

The real challenge is therefore not to reverse digitalisation.

It is to prevent the efficiency gained through interconnection from becoming an uncontrollable dependency.

This distinction is essential to understanding the future of industrial and technological policy.

For decades, optimisation favoured data centralisation, reduced redundancy and systems integration. These choices remain economically rational in many circumstances.

But resilience sometimes requires backup capacity, alternative procedures, multiple suppliers or partially independent infrastructures.

It means accepting certain additional costs to prevent a localised failure from triggering a general interruption.

Security thus becomes a question of balancing efficiency with continuity.

Conclusion — Power and Its Dependencies

In less than a decade, cyberattacks have revealed a new geography of global vulnerability.

WannaCry showed that healthcare systems could be disrupted by internationally propagating malware. NotPetya demonstrated that a destructive operation could cross borders and destabilise multinational corporations. SolarWinds exposed the risks associated with trust in technology suppliers. Colonial Pipeline connected information security with energy supply. Change Healthcare revealed the dependence of a healthcare system on its digital intermediaries. Attacks against telecommunications networks demonstrated that civilian infrastructure is also an intelligence target. Jaguar Land Rover illustrated how an IT incident could spread through an entire industrial value chain.

These events are not identical. Their perpetrators, objectives, mechanisms and consequences differ profoundly.

They nevertheless belong to the same historical transformation: digitalisation has made information a direct condition of the material functioning of societies.

Cyberspace is no longer a domain separate from the real economy. It has become one of its fundamental infrastructures.

The next stage will probably not be defined solely by more expensive attacks or more sophisticated software. It will depend on organisations' ability to preserve essential functions when certain systems become unavailable, compromised or untrustworthy.

The true measure of technological power may therefore evolve.

It may no longer reside solely in the volume of data processed, the speed of networks or the degree of automation achieved, but also in the ability to withstand disruption without losing control of operations.

For the most significant vulnerability of digital societies does not necessarily lie in how easily they can be attacked.

It lies in the growing number of functions they can no longer perform when their systems stop responding.

Main Sources

  • Cybersecurity and Infrastructure Security Agency (CISA) — Technical alerts, vulnerability analyses, critical infrastructure security and software supply-chain compromise campaigns.
  • National Cyber Security Centre (NCSC), United Kingdom — Analyses of WannaCry, NotPetya and threats affecting British organisations.
  • Federal Bureau of Investigation (FBI) — Official communications on Salt Typhoon operations and attribution of the Bybit attack.
  • U.S. Department of Health and Human Services (HHS), Office for Civil Rights — Notifications and assessment of the Change Healthcare data breach.
  • Cyber Monitoring Centre, United Kingdom — Assessment of the economic consequences of the Jaguar Land Rover incident, October 2025.
  • European Union Agency for Cybersecurity (ENISA) — Reports on the European cyberthreat landscape, ransomware and systemic risks.
  • Europol — Reports on organised cybercrime, extortion networks and international law-enforcement operations.
  • European Commission — NIS2 Directive and Digital Operational Resilience Act (DORA).
  • American and British authorities — Public attribution statements concerning major cyberespionage and destructive cyberoperations.

Methodological note: the economic figures cited reflect the assessments available for the incidents concerned. Modelled estimates, reported losses and the value of stolen assets are distinguished throughout the analysis. State attributions are presented as findings or statements by the relevant authorities, without treating them as universally established judicial determinations.