World media reports say health and security chiefs have warned of possible fresh disruption from the global cyber-attack when workers switch on their computers for the first time at the start of the working week.

Europol, the pan-EU crime-fighting agency, said the threat was escalating and predicted the number of “ransom ware” victims was likely to grow across the private and public sectors, according to The Guardian.

One in five NHS Trusts was reportedly hit by the “Wannacry” attack on Friday.  Operations planned for Monday have been cancelled at several major hospitals, with patients facing disruption to their treatment because computers used to share patients’ test results and scans with doctors remain frozen.

The National Cyber Security Center warned that more cases of the ransomware were expected to come to light beyond the NHS and “possibly at a significant scale”.  However, it stressed there were software updates that were easy to install and can prevent the spread of the malware which requests victims pay $300 or risk losing all their files.

Many of England’s 8,000 GP surgeries could be affected for the first time on Monday. “Some parts of the NHS will not have clocked there is an issue,” a spokeswoman for NHS Digital told The Guardian.  “If that is going to happen, it is more likely to be primary care trusts.”

Surgeries were sent a bulletin on Sunday advising them what to do if they discovered their computers had been hacked and how to get support from NHS Digital and the National Cyber Security Center.

The attack has reportedly hit companies and other organizations, from Russia to Australia, and Europol estimates there have been 200,000 victims in at least 150 countries.

The hackers remain undetected but are believed to have so far gathered only $42,000 in ransom payments from about 100 victims.  This is expected to rise as the malware threatens that the ransom will double if victims fail to pay $300 in bitcoin currency within three days. It threatens files will be deleted if there is no payment within seven days.

Organizations across the globe are involved in what Europol described as a complex international investigation.

In a blog post yesterday, Microsoft’s president, Brad Smith, appeared to acknowledge that the ransomware attack used a hacking tool built by the US National Security Agency, which leaked online in April.  He said governments should “treat this attack as a wake-up call” and “consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits”.

The NSA and White House did not immediately respond to requests for comment about the Microsoft statement.

Cyber security experts said the malware could spread through computers with unpatched versions of Microsoft Windows.  They have urged users to only run their computers in safe mode until they have checked that the update blocking the ransomware is installed.