At around 17:00 EST on December 22, 1988, a worm was detected on the Space Physics Analysis Network (SPAN).
[1] The worm originated from a computer on the DECnet in Switzerland by a person using the multi-user login name PHSOLIDE.
At half past midnight on that day, it was designed to send out a message from Father Christmas to all users on the local rights database for each network.
It exclusively targeted VAX/VMS systems,[4] but it did not perform any other actions than sending that message.
[6] The Father Christmas worm had the effect of strengthening security measures on SPAN and the DECnet Internet.