Shipping · 2017
Maersk and the NotPetya cyberattack
Rebuild the entire company in ten days.
What happened
On June 27, 2017, NotPetya reached Maersk through a compromised update to M.E.Doc, accounting software used by its Ukrainian operation. Once inside, the malware combined a Windows exploit with stolen administrative credentials and legitimate management tools to spread across the company.
Booking systems, port-terminal access and Active Directory failed worldwide. Maersk rebuilt about 4,000 servers, 45,000 PCs and 2,500 applications in roughly ten days. A surviving domain controller in Ghana helped make that reconstruction possible, but its survival was accidental, not a planned backup strategy. Employees kept much of the cargo moving manually, and Maersk estimated the loss at $250–300M.
What would have changed it
Recovery cannot depend on the one server that happened to survive. We design isolated recovery paths, protect privileged credentials and prove that critical systems can be rebuilt.