The Most Destructive Computer Viruses in History (And What They Actually Taught Us)

Three outbreaks, two decades apart, cost the world tens of billions of dollars combined. Here's what actually happened — and what got exaggerated along the way.

Ask most people to name a "dangerous computer virus" and they'll picture something out of a movie: a hacker in a hoodie, a countdown clock, a system going dark all at once. The real history is messier and, in some ways, more interesting. A few pieces of malware caused genuine global damage — measured in billions of dollars and, in one case, disrupted hospitals treating actual patients. Others get inflated in retellings until the numbers stop meaning anything.

This piece looks at three outbreaks with well-documented paper trails: ILOVEYOU (2000), MyDoom (2004), and WannaCry (2017). Each one is often cited as "the worst virus ever," and each claim needs its own context.

ILOVEYOU: the love letter that broke email

On May 4, 2000, people around the world opened emails with the subject line "ILOVEYOU" and an attachment named LOVE-LETTER-FOR-YOU.TXT.vbs. The .vbs extension was hidden by default Windows settings, so the file looked like a harmless text document.[1] It wasn't. Opening it ran a Visual Basic script that overwrote files, then emailed itself to every contact in the victim's Outlook address book.[1][2]

It moved fast. Within days it had reached tens of millions of systems — reporting on the exact count varies by source, with figures ranging from roughly 45 million to 50 million infected computers.[2][3] Major organizations took drastic action. Ford Motor Company shut down its email system entirely to stop the spread, and government bodies including the Pentagon, the CIA, and the British Parliament were affected or took systems offline as a precaution.[3][4]

What did it cost? This is where the numbers get slippery. Estimates for total economic damage span a huge range — from roughly $5.5 billion up to $15 billion — because most of the loss was intangible labor cost for cleanup rather than a single measurable bill.[2][4] A commonly cited midpoint figure is around $10 billion.[3][5] Whatever the exact number, most of that cost came from IT staff spending days removing the worm and restoring lost files, not from any single dramatic act of destruction.

The worm is believed to have originated from a computer science student in the Philippines, Onel de Guzman.[2] At the time, the Philippines had no law that criminalized writing malware, so no charges stuck — an embarrassing gap that the country closed shortly afterward with its first cybercrime statute.[5] That's a detail worth sitting with: the most expensive malware outbreak of its era, in dollar terms, was written by one person with no computer crime law to answer to.

MyDoom: the fastest spreader, four years later

If ILOVEYOU proved email could carry a worm to tens of millions of inboxes, MyDoom in January 2004 proved it could go even faster. At its peak, roughly one in five emails circulating on the internet was carrying the worm.[6][7] It arrived disguised as a bounced-message notification, which made it easy to click without thinking.[7]

MyDoom wasn't just a nuisance. The original variant had a built-in, timed denial-of-service payload aimed at SCO Group's website, tied to SCO's legal disputes with the open-source community at the time.[6] When the DoS trigger activated on February 1, 2004, infected machines flooded SCO's servers with traffic. SCO confirmed the attack made its website completely unavailable and the company eventually moved the site to a new address to escape the flood.[6] A later variant retargeted Microsoft.[7]

Damage estimates for MyDoom are among the highest ever attached to a single piece of malware — commonly cited around $38 billion, with some retrospective, inflation-adjusted figures running higher still.[8][9] As with ILOVEYOU, treat any single number as an estimate rather than an audited total; different analysts count different categories of loss (lost productivity, cleanup labor, DoS-related outages) and arrive at different totals.

MyDoom also opened a backdoor on infected machines and, in some variants, blocked access to dozens of antivirus vendor websites — an early example of malware actively working to prevent its own removal.[7] Despite an extensive investigation and bounties from both SCO and Microsoft totaling over $250,000 for information leading to the author, whoever wrote MyDoom was never publicly identified or charged.[6]

WannaCry: when a leaked NSA exploit met unpatched hospitals

WannaCry is a different kind of story, because it's the best-documented of the three by official government sources. On May 12, 2017, a ransomware worm began spreading across networks worldwide, encrypting files and demanding a Bitcoin ransom — starting around $300, doubling after three days.[10] The U.S. Department of Homeland Security's US-CERT (now part of CISA) published a formal alert, TA17-132A, the same day, and continued updating it as the incident developed.[10][11]

The mechanism is well established. WannaCry spread using EternalBlue, an exploit for a Windows SMBv1 vulnerability — tracked across several CVEs including CVE-2017-0144 — that had been developed by the NSA and then leaked publicly by a group called the Shadow Brokers in April 2017.[12][13] Microsoft had actually shipped a patch for the underlying flaw, MS17-010, two months earlier, in March 2017.[10][12] Systems that had applied that patch were not vulnerable to the EternalBlue-based spread. That's the detail that turns WannaCry from a pure "attack" story into partly a patching story.

CISA's alert reported tens of thousands of infections across more than 150 countries within the first days.[11] Independent estimates of the total infected system count generally land between roughly 200,000 and 300,000 machines.[13][14] The UK's National Health Service was one of the highest-profile victims: infected trusts had staff locked out of systems and had to divert some emergency patients while systems were restored.[15] Total economic damage estimates vary widely, generally cited in the low billions of dollars, reflecting disrupted operations and remediation costs across affected sectors rather than ransom payments alone.[15][14]

The outbreak was slowed, somewhat by accident, when a security researcher named Marcus Hutchins registered a domain hardcoded into the malware, which triggered a kill switch and interrupted further spread.[13] The U.S. government later publicly attributed WannaCry to the North Korean government, a position also taken by the UK, Australia, Canada, and New Zealand.[10][13]

What these three outbreaks have in common

Put side by side, ILOVEYOU, MyDoom, and WannaCry don't share a single attack technique. One relied on social engineering and a hidden file extension. One combined mass emailing with a scheduled denial-of-service payload. One exploited an unpatched, known vulnerability to spread without any user interaction at all. What they share is scale — each one crossed borders, industries, and government systems within days — and a recurring root cause: basic security hygiene that didn't keep up with how fast malware could move once released.

Outbreak	Year	Primary vector	Cited damage estimate
ILOVEYOU	2000	Email attachment, social engineering	~$5.5B–$15B (range across sources)[2][4]
MyDoom	2004	Email attachment disguised as bounce notice	~$38B or higher[8][9]
WannaCry	2017	EternalBlue SMB exploit, unpatched systems	Low billions (estimates vary)[15][14]

Every damage figure above should be read as an estimate, not an audited number — a point worth repeating, because these numbers get repeated so often they start to sound like verified facts. They aren't. They're informed reconstructions built from surveys, cleanup-cost reporting, and analyst modeling, done after the fact.

What defenders actually took away from these events

None of these three outbreaks required exotic defenses to stop. That's arguably the most uncomfortable lesson.

• Patch on a schedule, not just when convenient. WannaCry spread almost entirely through systems that hadn't applied a patch that had already existed for two months.[10][12]
• Treat unexpected attachments as suspicious by default. Both ILOVEYOU and MyDoom relied on curiosity — a love letter, a bounced message — rather than any technical flaw in the email client itself.[1][7]
• Segment networks and disable unused protocols. SMBv1, the protocol EternalBlue targeted, was legacy even in 2017. Disabling protocols nobody actively needs removes entire attack paths.[12]
• Have an incident response plan that doesn't depend on email. Several organizations hit by ILOVEYOU had to communicate about the outbreak without using the very system that was compromised.[3]

Security takeaway

It's tempting to treat historical malware outbreaks as relics — old news from before modern endpoint detection and automated patch management. But the underlying failure modes haven't gone anywhere. Unpatched known vulnerabilities and convincing social engineering are still, by a wide margin, the two most common ways real intrusions start today. ILOVEYOU, MyDoom, and WannaCry are worth studying not because they're exotic, but because they aren't.

Sources & References

1. EBSCO Research Starters — "ILOVEYOU Virus Attacks Computers." ebsco.com
2. Document repository summary citing origin and damage range for ILOVEYOU. scribd.com
3. Dark Reading — "It Was 20 Years Ago Today: Remembering the ILoveYou Virus," May 5, 2020. darkreading.com
4. TechTarget — "What is the ILOVEYOU virus and how do you protect against it?" techtarget.com
5. Uprise Partners — "ILOVEYOU Virus: Happy 25th Anniversary to the 'Love Bug' that Cost the World $10 Billion." uprisepartners.com
6. Avasant — "My Doom Virus Update: Fastest Spreading Virus Ever," February 2004. avasant.com
7. Harrisburg University IT Help Community — "The MyDoom Worm: A Retrospective." ithelp.harrisburgu.edu
8. NITK Industry Engagement Blog — "MyDoom - The Worst Computer Virus in History." ie.nitk.ac.in
9. Okta — "What Is MyDoom Malware? History, How It Works & Defense." okta.com
10. CISA — Alert TA17-132A, "Indicators Associated With WannaCry Ransomware." cisa.gov
11. CIS / MS-ISAC — "Cyber Alert: WannaCry Ransomware," May 15, 2017. cisecurity.org
12. CIS / MS-ISAC — "Security Primer: EternalBlue" (CVE-2017-0143 through CVE-2017-0148). cisecurity.org
13. CCDCOE Cyber Law Toolkit — "WannaCry (2017)" incident summary. cyberlaw.ccdcoe.org
14. Longterm Wiki — "WannaCry (2017)" incident summary with damage-estimate range. longtermwiki.com
15. IONOS Digital Guide — "What is WannaCry?" ionos.com