The WannaCry "ransomware" cyber attack hobbled Chinese traffic police and schools on Monday as it rolled into Asia for the new work week, while authorities in Europe said they were trying to prevent hackers from spreading new versions of the virus.
In Britain, where the virus first raised global alarm when it caused hospitals to divert ambulances on Friday, it gained traction as a political issue just weeks before a general election. The opposition Labour Party accused the Conservative government of leaving the National Health Service vulnerable.
Shares in firms that provide cyber security services rose with the prospect that companies and governments would have to spend more money on defences.
Some victims were ignoring official advice and paying the $300 ransom demanded by the cyber criminals to unlock their computers, which was due to double to $600 on Monday for computers hit by Friday's first wave.
Brian Lord, managing director of cyber and technology at cyber security firm PGI, said victims had told him the hackers offered good service, with helpful advice on how to pay: "One customer said they actually forgot they were being robbed."
But the hackers do not appear so far to have been well rewarded: only about $50,000 has been transferred to their online wallets so far, according to Elliptic Labs which tracks transactions using the internet currency bitcoin.
Although the virus's spread was curbed over the weekend in most of the world, France, where carmaker Renault was among the world's highest profile victims, said more attacks were likely.
"We should expect similar attacks regularly in the coming days and weeks," said Giullaume Poupard, head of French government cyber security agency ANSSI. "Attackers update their software ... other attackers will learn from the method and will carry out attacks."
Companies and governments spent the weekend upgrading software to limit the spread of the virus. Monday was the first big test for Asia, where offices had already mostly been closed for the weekend before the attack first arrived.
British media were hailing as a hero a 22-year-old computer security whiz who appeared to have helped stop the attack from spreading by discovering a "kill switch" - an internet address which halted the virus when activated.
SPREAD SLOWING
China appeared over the weekend to have been particularly vulnerable, raising worries about how well the world's second largest economy would cope when it opened for business on Monday. However, officials and security firms said the spread was starting to slow.
"The growth rate of infected institutions on Monday has slowed significantly compared to the previous two days," said Chinese Internet security company Qihoo 360. "Previous concerns of a wide-scale infection of domestic institutions did not eventuate."
Qihoo had previously said the attack had infected close to 30,000 organisations by Saturday evening, more than 4,000 of which were educational institutions.
Yang Lin, a journalism student at China's Zhejiang University of Media and Communications, told Reuters she had lost her work from four years of study. She had just finished revising her thesis late on Friday when her screen went black and the hackers' message appeared.
"I was connected to the university network. I didn't open any link," she said. "I just cried. I was afraid to believe it, but had to accept it."
The virus hit computers running older versions of Microsoft software that had not been recently updated. Microsoft released patches last month and on Friday to fix a vulnerability that allowed the worm to spread across networks.
In a blog post on Sunday, Microsoft President Brad Smith appeared to tacitly acknowledge what researchers had already widely concluded: the attack made use of a hacking tool built by the U.S. National Security Agency and leaked online.
Russian President Vladimir Putin, noting the technology's link to the U.S. spy service, said it should be "discussed immediately on a serious political level".
"Once they're let out of the lamp, genies of this kind, especially those created by intelligence services, can later do damage to their authors and creators," he said.
Infected computers appear to largely be out-of-date devices that organisations deemed not worth the price of upgrading. Some have also been machines involved in manufacturing or hospital functions, difficult to patch without disrupting operations.
"The government's response has been chaotic, to be frank," the British Labour Party's health spokesman Jon Ashworth said. "They've complacently dismissed warnings which experts, we now understand, have made in recent weeks."
"The truth is, if you're going to cut infrastructure budgets and if you're not going to allow the NHS to invest in upgrading its IT, then you are going to leave hospitals wide open to this sort of attack."
Britain's National Health Service (NHS) is the world's fifth largest employer after the U.S. and Chinese militaries, Walmart and McDonald's. The government says that under a previous Labour administration the trusts that run local hospitals were given responsibility to manage their own computer systems.
WARNINGS GIVEN
Asked if the government had ignored warnings over the NHS being at risk from cyber attack, Prime Minister Theresa May told Sky News: "No. It was clear [that] warnings were given to hospital trusts."
An official from Cybersecurity Administration China (CAC) told local media on Monday that while the ransomware was still spreading and had affected industry and government computer systems, the spread was slowing.
Chinese government bodies from transport, social security, industry watchdogs and immigration said they had suspended services ranging from processing applications to traffic crime enforcement.
It was not immediately clear whether those services were suspended due to attacks, or for emergency patching to prevent infection.
"If a system supports some kind of critical processes those systems typically are very hard to patch ... We don't have a precedent for something of this scale (in China)," said Marin Ivezic, a cybersecurity expert at PwC in Hong Kong.
Affected bodies included a social security department in the city of Changsha, the exit-entry bureau in Dalian, a housing fund in Zhuhai and an industry watchdog in Xuzhou.
Energy giant PetroChina said payment systems at some of its petrol stations were hit, although it had been able to restore most of the systems.
Elsewhere in Asia, the impact seems to have been more limited. Japan's National Police Agency reported two breaches of computers in the country on Sunday - one at a hospital and the other case involving a private person - but no loss of funds.
Industrial conglomerate Hitachi Ltd. said the attack had affected its systems at some point over the weekend, leaving them unable to receive and send e-mails or open attachments in some cases.
In India, the government said it had only received a few reports of attacks on systems and urged those hit not to pay attackers any ransom. No major Indian corporations reported disruptions to operations.
At Indonesia’s biggest cancer hospital, Dharmais Hospital in Jakarta, around 100-200 people packed waiting rooms after the institution was hit by cyber attacks affecting scores of computers. By late morning, some people were still filling out forms manually, but the hospital said 70 percent of systems were back online.
South Korea's presidential Blue House office said nine cases of ransomware were found in the country, but did not provide details on where the cyber attacks were discovered. A coal port in New Zealand shut temporarily to upgrade its systems.
