It was a perfect summer afternoon in Copenhagen on June 27, 2017, when one of the world's largest corporations began to collapse. What happened that day serves as a stark reminder: cyber attacks can strike anyone, anywhere—from global giants to small businesses—and no organization is too big to fall.
When Giants Fall: The NotPetya Attack on Maersk
A.P. Møller-Maersk, the world's largest integrated shipping and container logistics company, controls nearly 20% of global shipping capacity. With 76 ports across every continent, approximately 800 seafaring vessels, and operations in 130 countries, Maersk is the circulatory system of the global economy.
On that June afternoon, within minutes, it all stopped.
Employees in Maersk's Copenhagen headquarters watched in horror as computer screens across open-plan offices blinked out in rapid succession—"Black, black, black. Black black black black black," one IT administrator later recalled. Within hours, key-card gates were paralyzed, digital phones went silent, and 45,000 computers across the global network displayed ominous messages: "Oops, your important files are encrypted."
The company responsible for moving tens of millions of tons of cargo—everything from diapers to medical supplies to manufacturing components—was dead in the water.
The Weapon: NotPetya
What hit Maersk wasn't ordinary ransomware. It was NotPetya, a Russian military cyberweapon that had been unleashed against Ukraine but spread globally with devastating speed.
NotPetya combined two powerful exploits:
- EternalBlue - A leaked NSA hacking tool that exploited Windows vulnerabilities
- Mimikatz - A password-extraction tool that allowed the malware to spread from computer to computer
"By the second you saw it," said Craig Williams, director of outreach at Cisco's Talos division, "your data center was already gone."
The Scale of Devastation
At Maersk:
- 45,000 PCs destroyed - Every employee machine wiped
- 4,000 servers crashed - Including critical domain controllers
- 17 of 76 ports paralyzed - From Los Angeles to Mumbai to Rotterdam
- Tens of thousands of trucks turned away - Creating miles-long traffic jams at terminals
- No bookings, no revenue - Core business operations ceased
- $250-300 million in losses - Likely understated according to internal sources
At the Port of Elizabeth, New Jersey alone, hundreds of 18-wheelers lined up for miles. Refrigerated containers full of perishable goods had nowhere to go. Manufacturing supply chains ground to a halt. One Maersk customer described receiving a million-dollar reimbursement check from the company after having to charter a private jet to move their cargo.
Beyond Maersk:
NotPetya wasn't just a Maersk problem. It was a global catastrophe:
- Merck (pharmaceutical giant): $870 million in losses
- FedEx/TNT Express: $400 million in damages
- Saint-Gobain (construction): $400 million hit
- Mondelēz (Cadbury chocolate maker): $188 million loss
- Reckitt Benckiser (Durex manufacturer): $129 million impact
- Hospitals in Pennsylvania to chocolate factories in Tasmania
Total global damage: Over $10 billion
The White House later confirmed Russia's military was responsible for the attack—an act of cyberwar against Ukraine that spiraled into the most destructive cyber attack in history.
The Heroic Recovery
The Ghana Miracle
As Maersk's IT staff scrambled to rebuild their network from a makeshift 24/7 emergency operations center in Maidenhead, England, they faced a nightmarish realization: they had backups of almost everything except the domain controllers—the master map of Maersk's entire network.
Without domain controllers, they couldn't recover anything.
After a frantic global search, they found one single surviving domain controller—in a remote office in Ghana. It had survived purely by accident: a power outage had knocked it offline just before NotPetya struck.
But the Ghana office's internet bandwidth was so limited it would take days to transmit the data to London. And the local staff didn't have British visas to fly there themselves.
The solution? A relay race: A Ghanaian staffer flew to Nigeria to meet another Maersk employee at the airport, handed off the hard drive, and that employee flew to London carrying the keystone of Maersk's entire recovery.
Rebuilding from Zero
The Maidenhead emergency center operated around the clock for nearly two months:
- Deloitte was given essentially a blank check to fix the problem
- Up to 400 Maersk staff and 200 Deloitte consultants working simultaneously
- Staff sleeping under desks and in conference rooms
- Every available hotel room within tens of miles booked
- All pre-attack equipment confiscated for fear of reinfection
- Hundreds of new laptops bought from local electronics stores
Meanwhile, back at terminals around the world, Maersk staff worked with whatever tools remained:
- Paper documents taped to shipping containers - Orders taken via personal Gmail accounts - Bookings made through WhatsApp - Inventory tracked in Excel spreadsheets
"I can tell you it's a fairly bizarre experience to find yourself booking 500 shipping containers via WhatsApp," one customer recalled, "but that's what we did."
The Lessons: Why This Matters to You
1. Size Provides No Protection
If a company controlling 20% of global shipping capacity can be brought to its knees in minutes, no organization is safe. Small businesses, medium enterprises, municipalities, hospitals, schools—all are vulnerable.
2. The Interconnected Web
NotPetya began with a single infected computer in a Maersk finance office in Odessa, Ukraine. One machine running compromised Ukrainian accounting software created the foothold that brought down a global empire.
In today's interconnected world, one vulnerability anywhere can become a catastrophe everywhere.
3. The Cost of Delayed Security
Before NotPetya, Maersk security executives had proposed a comprehensive network security overhaul, warning specifically about insufficient network segmentation—the exact vulnerability NotPetya exploited.
The upgrade was approved and budgeted but never implemented because it wasn't tied to executive bonuses.
Internal sources say some Maersk servers were still running Windows 2000—an operating system so old Microsoft no longer supported it.
The cost of that delay: hundreds of millions of dollars, months of disruption, and incalculable damage to the global supply chain.
4. Backups Are Not Enough
Maersk had backups. They had redundancy. They had domain controllers designed to sync with each other as automatic backups.
But they hadn't planned for simultaneous global infection. Every domain controller was wiped at once. Only a power outage in Ghana—pure luck—saved them.
Your backup strategy must account for worst-case scenarios, not just typical failures.
5. Cyber Attacks Know No Borders
NotPetya was a Russian weapon aimed at Ukraine. But in cyberspace, distance is no defense. The malware spread from Kiev to Copenhagen to Mumbai to Los Angeles in hours.
As Joshua Corman, a cybersecurity fellow at the Atlantic Council, observed: "Somehow the vulnerability of Ukrainian accounting software affects US vaccine supply and global shipping? The physics of cyberspace are wholly different from every other war domain."
What Changed After NotPetya
Maersk's chair, Jim Hagemann Snabe, later said the attack became a "very significant wake-up call"—then added with Scandinavian understatement, "You could say, a very expensive one."
Post-NotPetya, Maersk transformed its security posture:
- Multifactor authentication rolled out company-wide
- Windows 10 upgrade finally implemented
- Network segmentation properly deployed
- Security requests immediately approved (previously a bureaucratic nightmare)
- Cybersecurity positioned as a "competitive advantage"
The company learned, painfully, that security investments are not optional expenses—they are survival requirements.
The Warning We Must Never Forget
Seven years after NotPetya, the threat landscape has only intensified:
- Ransomware attacks continue to escalate - Targeting schools, hospitals, municipalities, and businesses of all sizes
- Nation-state actors grow bolder - Russia, China, North Korea, and Iran conduct increasingly aggressive cyber operations
- Supply chain attacks multiply - Compromising one vendor can infect hundreds of customers
- Critical infrastructure remains vulnerable - Power grids, water systems, transportation networks face constant threats
The lesson of Maersk is universal: Cyber attacks do not discriminate. They strike Fortune 500 companies and family businesses alike. They shut down global shipping giants and local hospitals. They cost hundreds of millions or thousands—but they always cost something.
Protecting Your Organization
Whether you're a multinational corporation or a small business, the fundamentals of cyber resilience remain the same:
1. Patch Management
Keep all systems updated. The EternalBlue vulnerability NotPetya exploited had been patched by Microsoft—but too many organizations hadn't applied it.2. Network Segmentation
Don't let malware spread freely. Segment your network so a breach in one area can't cascade everywhere.3. Multifactor Authentication
Password theft is one of the most common attack vectors. MFA blocks most credential-based attacks.4. Tested Backups
Have backups. Test them regularly. Store them offline. Ensure they can actually restore your systems when needed.5. Incident Response Planning
Have a plan before disaster strikes. Know who to call, what to do, and how to recover.6. Security-First Culture
Make security everyone's responsibility, from executives to entry-level employees. Tie security goals to performance metrics.7. Assume Breach
Plan for when—not if—you're compromised. How quickly can you detect it? How fast can you contain it? How efficiently can you recover?The Human Element
Beyond the statistics and dollar figures, NotPetya affected real people:
- Truckers waiting for hours in summer heat, losing a day's wages
- Logistics coordinators scrambling to reroute critical shipments
- Factory workers sent home when components didn't arrive
- IT staff sleeping under desks for weeks to rebuild their company
- Customers watching perishable goods rot in paralyzed ports
Jeffrey Bader, president of a Port Newark trucking group, summed up the frustration: "It was a nightmare. We lost a lot of money, and we're angry."
These weren't just numbers on a spreadsheet. These were livelihoods disrupted, businesses damaged, and stress imposed on thousands of workers who had nothing to do with the attack.
The Ongoing Threat
Security experts universally agree: NotPetya-scale attacks will happen again.
Global corporations are too interconnected, information security too complex, and attack surfaces too broad to guarantee protection against determined state-sponsored hackers.
Meanwhile, nation-states continue developing offensive cyber capabilities. The US government's sanctions against Russia for NotPetya came eight months after the attack—far too late to serve as meaningful deterrence.
"The lack of a proper response has been almost an invitation to escalate more," says Thomas Rid, a political science professor at Johns Hopkins.
Conclusion: A Call to Vigilance
The Maersk NotPetya attack of June 27, 2017, stands as one of the defining moments in cybersecurity history. In the span of a single summer afternoon, a Russian military cyberweapon demonstrated that:
- No organization is too large to fall - Geographic distance provides no protection - Interconnected systems create cascading vulnerabilities - The cost of delayed security is measured in hundreds of millions - Cyber attacks are now weapons of war with global civilian casualties
But perhaps most importantly, NotPetya proved that cyber attacks can strike anyone. From the world's largest shipping company to a small accounting firm in Ukraine to hospitals, manufacturers, and retailers around the globe—no one is immune.
The question is not whether your organization will face a cyber threat. The question is whether you'll be prepared when it arrives.
As Maersk learned the hard way, preparation is expensive. But the cost of unpreparedness is catastrophic.
Seven years later, as we remember that June afternoon when the world's shipping infrastructure went dark, we must recommit ourselves to the vigilance, investment, and cultural change required to build resilient organizations.
Because in cyberspace, every barbarian is already at every gate. And the only defense is being ready.
Remember: Whether you're a Fortune 500 company or a family business, a municipal government or a healthcare provider, a school or a nonprofit—cyber attacks don't discriminate. We must never forget that in the digital age, we are all potential victims. And that means we all must be defenders.
Sources: WIRED "The Untold Story of NotPetya", CSO Online, Control Engineering, LRQA, Columbia University Case Study, multiple industry reports