On a Sunday afternoon in 2005 at a busy hospital in the Pacific Northwest, computers started running slower and documents would not print. By Monday morning, the situation became worse as more employees returned to work and logged on to their computers. Even stranger things started happening, such as operating-room doors stopped opening, pagers wouldn’t work, and computers in the intensive care unit shut down. By 10:00 a.m., all 50 people in the hospital’s information-technology department were summoned, but their efforts made little difference.

As the hospital’s information-technology staff discovered, the hospital was under attack by a botnet, a network of computers infected with malware that was controlled by three hackers. The trio exploited a flaw in the Microsoft Windows operating systems that let them install pop-up ads on the hospital’s computers. They got access to the first computer on Sunday and then started spreading the infection to other computers through the hospital’s network. As each computer became infected, it turned into another bot or zombie, which would in turn scan the hospital’s network looking for new victims to infect. As a result, the network became clogged with zombie traffic and hospital communications began to break down. Initially, the hospital’s technology staff tried to halt the attack by shutting off the hospital from the Internet, but by then it was too late. The bots were inside the hospital’s computer systems and infecting other computers faster than they could be cleaned.

By Monday afternoon, the IT department figured out which malware the bots were installing on computers and wrote a script, which was pushed out hourly, directing computers to remove the bad code. The script helped to slow the bots down a bit.