The Maersk Cyber Attack: What Really Happened?

You’re running the biggest shipping empire on Earth. Massive vessels are zig-zagging across oceans, carrying containers stacked like Legos. Every minute counts. The engine room of global trade is roaring.

Then one Tuesday morning in June 2017, the entire operation flatlines.

No emails. No bookings. No idea where half the containers are. Ports are frozen. Phones are useless. Computers? Dead weight. You can’t even print a shipping manifest.

That was the reality for Maersk on June 27, 2017. And the culprit wasn’t a storm or a strike—it was a piece of cyber sabotage called NotPetya.

What Was NotPetya, Really?

You ever get one of those sketchy pop-ups demanding money to unlock your laptop? Now imagine that, but weaponized, and instead of just annoying you—it wipes out entire corporations.

NotPetya pretended to be ransomware. It flashed a screen saying “Pay $300 in Bitcoin or your files are gone.” Except… there was no way to get your files back. It wasn’t ransomware—it was a wiper, dressed up to look like a ransom scheme.

Translation? It was never about money. It was about wrecking stuff. Fast.

Cybersecurity pros quickly figured out it had no recovery logic built in. It was designed to destroy, not extort. Think of it like the Joker wearing a ski mask—pointless chaos, just because it can.

How Did NotPetya Infect Maersk?

The entry point was a legit accounting software used widely in Ukraine called M.E.Doc. Maersk had operations in Ukraine, and just like many other companies there, they used this software to stay tax-compliant.

But one routine software update changed everything.

Attackers had hijacked M.E.Doc’s update system. When Maersk’s Ukrainian team downloaded the latest update (you know, doing everything “right”), they unknowingly gave NotPetya a golden ticket onto their network.

And this thing? It didn’t stroll. It sprinted.

Using powerful exploits like EternalBlue (stolen from the NSA, fun fact) and credential-hacking tools like Mimikatz, NotPetya jumped from one system to another like a virus on caffeine.

Even patched, secure systems weren’t safe. Once inside, it spread faster than office gossip after layoffs.

Before anyone could blink, Maersk’s entire digital universe collapsed:

17 shipping terminals went dark
45,000 computers knocked out
Thousands of servers? Gone
Bookings, invoices, customs docs, emails—obliterated

Imagine trying to run the world’s largest shipping operation… with zero functioning tech. Yep, exactly that.

The History of the Maersk Cyber Attack

This didn’t really start in 2017, it all started from the early 2014s.

Pre-Attack Context (2014–2017):

Back in 2014, Russia annexed Crimea, and everything between Russia and Ukraine went from political tension to a full-on digital battlefield. But this wasn’t just a cold war with words—it was a keyboard war.

Between 2015 and 2016, Ukraine wasn’t just dealing with bombs or borders. It became a testing ground for cyber weapons. Think government websites knocked offline. Power grids shut down in the middle of winter. Banks frozen.

And every attack got nastier, smarter, and scarier. Little did anyone know, the biggest hit was still loading…

June 2017: NotPetya Is Born

You know, enjoying the start of a long weekend, celebrating the Constitution Day on a random June 27, 2017, and right then—bam—NotPetya strikes.

At first it

But here comes the interesting part it was never about the money.

NotPetya was the digital equivalent of a smoke grenade with nails in it. There was no recovery mechanism built into the malware. It didn’t even have real instructions for decryption. You could pay up… and your files would still be toast.

This wasn’t a cybercriminal trying to make rent. It was pure sabotage—silent, fast, and absolutely ruthless.

How’d it get in?

Through a seemingly harmless software update.

The attackers targeted M.E.Doc, a popular piece of accounting software used by thousands of Ukrainian businesses. One of its routine updates had been hijacked and injected with NotPetya.

If your company installed the update, you basically opened the door and invited in the devil—unknowingly.

How Maersk Was Infected

Maersk had a branch office in Ukraine that used M.E.Doc.

One compromised system was enough: once NotPetya breached their Ukrainian server, it spread across Maersk’s global IT network, affecting offices, data centers, terminals, and ships in over 130 countries.

Within Hours: Maersk Systems Crumble

Maersk’s entire IT infrastructure collapsed:
- Phones, computers, printers, servers eventually offline
- Ports halted globally
- Booking systems, manifests, shipping logistics—all inaccessible
Their logistics arm, APM Terminals, went dark in 76 ports.
Customers couldn’t locate their cargo or place orders—container operations froze.

Recovery: From Chaos to Reboot

Maersk shut down its global network in record time to stop the spread.
They reverted to manual processes like WhatsApp, Excel, and whiteboards to keep shipments moving.
Within 10 days, Maersk reinstalled over 4,000 servers, 45,000 PCs, and 2,500 applications from scratch.
Their saving grace? A single clean backup of their domain controller, which was powered off in an office in Ghana during the attack. This server was flown to Maersk’s London HQ, enabling full recovery.

Financial & Global Fallout

Maersk alone reported losses between $250M–$300M.
Global economic damage caused by NotPetya reached over $10 billion, affecting companies like:
- FedEx (TNT Express)
- Merck Pharmaceuticals
- Rosneft
- Mondelez (maker of Oreos)
The attack was later attributed to Russian military hackers (GRU) by the U.S., U.K., and NATO—seen as part of cyberwarfare against Ukraine.

Why Maersk?

Interestingly, Maersk wasn’t a direct target. NotPetya was meant to destabilize Ukraine, but it spread far beyond due to lack of segmentation in global corporate networks. Maersk was collateral damage—but it showed the world how devastating a nation-state cyber weapon could be.

Long-Term Legacy

Maersk overhauled its cybersecurity strategy, transforming it into a core pillar of their operations.
Their case is now a Harvard Business School study, taught globally as a gold standard in cyber resilience and crisis response.
The attack also triggered global cybersecurity reforms, especially around:
- Supply chain risk management
- Network segmentation
- Zero trust architecture
- Board-level cyber strategy alignment

Timeline:

Date	Event
June 27, 2017	NotPetya launches in Ukraine via M.E.Doc software
Within hours	Maersk systems worldwide are infected
June 28, 2017	Global port operations are halted
July 1–7, 2017	Maersk restores operations via manual workarounds
July 7–10, 2017	Ghana backup is flown in and recovery begins
Late July 2017	Most Maersk systems are fully restored
2018	U.S. and allies blame Russian GRU for NotPetya
2020+	Maersk publishes lessons, transforms cybersecurity model

What Was the Impact on Maersk?

Ports disabled across 17 of their 76 terminals
4,000 servers and 45,000 PCs wiped clean
Booking systems shut down, operations halted, containers stranded, refrigerated goods at risk
Estimated financial loss: $250–300 million to Maersk alone, global costs soared past $10 billion

Hollywood wouldn’t script a scenario more chaotic than frozen cranes, packed terminals, and phones that just… didn’t work.

How Did Maersk Respond?

Maersk’s crisis response? Legendary.

Disconnected the global network within two hours to stop the spread
Switched to manual, paper-driven operations, accepting bookings via Gmail and WhatsApp
Assembled 600 cross-functional experts (Maersk + Deloitte) in a UK emergency hub
Rebuilt infrastructure: 4,000 servers and 45,000 PCs restored in just 10 days
Leveraged a clean domain-controller backup from Ghana, flown physically to London

Their resilience strategy was a masterclass in rapid response under pressure.

What Lessons Did We Learn From The Maersk Crisis

When cyber attacks like the Maersk crisis happens, there are always lessons to be learned from their mistake.

1. Never underestimate supply-chain vulnerabilities

Attackers struck through an external software vendor, and that was enough to cripple a global titan.

2. Patch quickly and consistently

NotPetya exploited old, unpatched systems across Maersk’s IT landscape.

3. Segment networks and restrict credentials

Without proper segmentation and credential hygiene, lateral spread was explosive.

4. Offline backups are life-savers

Maersk’s clean backup in Ghana saved the day, reminding us that “backup your backup” isn’t optional.

5. Have a practiced incident response plan

From immediate shutdowns to communication via WhatsApp, Maersk’s plan kicked in fast.

6. Transparency builds trust

Maersk communicated openly, “Bring out your dead” internal policy, earning customer support.

How Has Maersk Upgraded Its Cyber Security?

Post-NotPetya, Maersk transformed cybersecurity from checkbox to business asset:

Mandated multi-factor authentication and upgraded to Windows 10
Built geographically redundant backups, no more single points of failure
Adopted a risk-based, proactive security culture, IT requested features get green-lit fast
Encourages board-level cybersecurity awareness, C-suite bought in as a competitive edge

Why This Attack Still Matters in 2025

Fast forward to 2024–25: cyber threats have only grown sharper in the maritime world. The shipping industry saw 64 major cyber incidents in 2023, mostly nation-state–linked.

Digitization of ships and ports is increasing the attack surface, and Maersk’s experience is a wake-up call: scale makes you vulnerable. As Maersk CEO put it at Davos: cyber resilience is now a competitive advantage, not optional .

Bottom Line

The Maersk cyber attack isn’t just another headline event; it’s a textbook case in the power and peril of cyber warfare. Supply-chain attacks, patching delays, network misconfigurations, and governance failures came together for a global disruption.

But Maersk’s rapid recovery, implemented lessons, and cultural change show that even the biggest crises can be remediated. Today, Maersk stands not only as a shipping leader but a cyber resilience pioneer.

How Does BYTGRC Helps?

Audit vendor pathways, third-party tools are high-risk diving boards
Patch and segment relentlessly, no weak links in the chain
Backup offsite, backup offline, your lifeline in chaos
Plan, rehearse, communicate, from IT to boardroom
Make cybersecurity a business asset, it’s the new strategic frontier

FAQs

What made NotPetya so destructive?
A wiper disguised as ransomware, no reversal, total data loss.
Was Maersk the target?
No, it was collateral, caught in Ukraine’s wider cyber conflict.
How long did recovery take?
Booking functions resumed in ~10 days, full IT rebuild took weeks.
Could this attack repeat?
Absolutely, lack of patching, sprawling supply chains, and geopolitics create fertile ground.
Did backups really save them?
Yes, a powered-down Ghana server held the only clean copy.
Was ransomware involved?
Not really, NotPetya was designed to destroy, not ransom.
How did Maersk communicate?
Openly, customers appreciated honesty, even during the system blackout .
Lessons for SMEs?
Yes. Smaller companies are even more vulnerable; scale doesn’t insulate you from risk.

Table of Contents