How Maersk Rebuilt Its IT in Ten Days After the NotPetya Cyberattack: A Cybersecurity Case Study

Real-world case study · Cybersecurity

Maersk was not the intended target of NotPetya, and that is what makes the case relevant to almost every business. A company can be hit as collateral damage from an attack aimed elsewhere, and its recovery plan is what decides how long the damage lasts.

At a glance

• Company: A.P. Moller – Maersk
• Industry: Shipping, ports and logistics
• Country: Denmark, operating globally
• Period: Attack on 27 June 2017; recovery over the following weeks
• Threat: NotPetya malware, which spread through a compromised update to Ukrainian accounting software
• Reported impact: USD 200-300 million (company estimate, Q2 2017 interim report)

The challenge

Global shipping runs on IT: bookings, container tracking, terminal operations and customer documents. When those systems stop, ships, ports and customers are affected within hours.

The situation before

Like most large companies, Maersk ran thousands of servers, tens of thousands of PCs and thousands of applications. NotPetya spread through a compromised update to Ukrainian accounting software and then moved across connected networks. Snabe described Maersk as “collateral damage of probably a state attack”.

The response

Maersk’s recovery was a full rebuild rather than a clean-up. Speaking at the World Economic Forum in January 2018, Snabe said: “We had to install 4,000 new servers, 45,000 new PCs, 2,500 applications. And that was done in a heroic effort over ten days.” He added that he would normally have expected such work to take six months.

Implementation

While systems were being rebuilt, the business kept operating by hand. According to Snabe, Maersk handled about 80% of normal volumes through manual processes during the outage. Public sources do not provide a step-by-step technical account of the rebuild, so this case study does not describe one.

Documented results

• Attack date: 27 June 2017
• Estimated impact on results: USD 200-300 million, according to Maersk’s Q2 2017 interim report
• Businesses mainly affected: Maersk Line, APM Terminals and Damco (CEO Søren Skou)
• 4,000 servers, 45,000 PCs and 2,500 applications reinstalled in about ten days (Snabe, January 2018)
• About 80% of normal volumes handled manually during the outage (Snabe)

The cost figures differ slightly between sources. The interim report gave USD 200-300 million; in his January 2018 remarks Snabe was reported as putting the damage at USD 250-300 million. This case study uses the company’s formal estimate as the primary figure.

Why this matters

Maersk’s experience shows two things at once. First, a single compromised piece of third-party software can take down an entire company network. Second, a business that can keep operating manually and rebuild quickly limits the damage. Prevention matters, but so do recovery speed and the ability to work without systems for a while.

Smaller businesses face the same pattern through ransomware, compromised email accounts and infected software updates. The scale is smaller; the impact on a small business can be just as serious.

What businesses can learn

• Keep offline, tested backups. Backups that malware cannot reach are what make a rebuild possible.
• Know what you run. An up-to-date list of servers, PCs and applications speeds up recovery.
• Segment your network. Limit how far an infection can spread from one machine or office.
• Plan manual fallbacks. Decide in advance how orders, billing and dispatch continue if systems are down.
• Treat software updates as a risk too. Vet suppliers and monitor what third-party tools can access.

Raymond Cardoza Enterprises perspective

For a growing business, cyber resilience starts with basics done well: backups that are tested, accounts protected with multi-factor sign-in, a list of critical systems and a written plan for working without them. We build these into every business solutions and IT and BPO outsourcing engagement, because a system you cannot recover is a risk, not an asset.

Sources and verification

Every figure in this case study comes from the sources below. Primary sources are listed first.

1. A.P. Moller – Maersk, Interim Report Q2 2017 (investor relations)
2. CNBC (16 Aug 2017): Maersk says June cyberattack could cost it up to $300 million
3. BleepingComputer (Jan 2018): Maersk reinstalled 45,000 PCs and 4,000 servers to recover from NotPetya attack