NotPetya wiped Maersk's computers worldwide — and cost it up to $300M

A.P. Moller-Maersk, the Danish group that operates the world's largest container shipping line, was hit in late June 2017 by NotPetya, a self-spreading worm that began in Ukrainian accounting software and raced across corporate networks worldwide. At Maersk it locked employees out of the systems the company uses to run its shipping terminals around the globe.

The disruption was immediate and global. For up to two days, affected terminals could not move cargo from ship to shore; Maersk's APM terminal at Pier 400 in the Port of Los Angeles, the port's largest cargo terminal, was closed from 27 June to 1 July, leaving at least one ship waiting at anchor. With their applications and data unavailable, staff improvised using Twitter, WhatsApp and Post-It notes to keep goods moving.

Maersk said no data was lost, no workers were endangered and ships kept sailing, but the cost of stopping and then rebuilding was enormous. The company estimated the attack cost it $200 million to $300 million, and the figure climbed as the task of rebuilding its IT added more on top. Reports put the scale of the rebuild at around 50,000 computers and thousands of servers reinstalled.

There was, as a Maersk spokeswoman put it, 'no benchmark for this.' The case became the textbook example of cyber risk as operational risk: a shipping giant did not lose a single vessel, yet a single worm moving through an unsegmented network could still close terminals on multiple continents and cost a quarter of a billion dollars.