NotPetya: one software update, five continents
A destructive malware attack aimed at Ukraine spread through an ordinary accounting-software update and stopped one of the world's largest shipping companies, a major drugmaker, and a global courier within hours.
Public reporting, not client work. Acervus was not involved in the events described in these case studies, which are drawn entirely from public reporting. Figures are as reported by the cited sources and have not been independently verified by Acervus.
- 64+countries with affected companies, according to Microsoft
- $10bn+estimated total damage worldwide
- $200–300MMaersk's own estimate of the impact on its results
- 49,000PCs and servers Maersk reinstalled in 10 days
01What happened
On June 27, 2017, malware later named NotPetya was pushed to organizations in Ukraine through the automatic update of M.E.Doc, an accounting package widely used to file tax returns there. Once inside a network it spread on its own, using a Windows vulnerability called EternalBlue, for which Microsoft had released a patch in March 2017. It looked like ransomware, but it destroyed data rather than holding it for ransom.
Any company with an office in Ukraine that used the software became a way in. Global networks did the rest. A.P. Moller-Maersk, which its chairman later said handles roughly a fifth of world trade, lost its IT systems worldwide. Staff processed about 80% of the work by hand while the company reinstalled 45,000 PCs, 4,000 servers, and 2,500 applications in ten days.
02How it spread across the economy
The disruption moved along supply chains. Maersk container terminals stalled on several continents. Merck reported lost sales of about $135 million in the following quarter and borrowed Gardasil 9 vaccine from the US Centers for Disease Control's pediatric stockpile while production recovered. Trading in FedEx shares was briefly halted after its TNT Express unit was hit. In Pennsylvania, a hospital system could not offer lab and imaging services at 14 offices. Russia's own oil producer, Rosneft, was among the victims.
In February 2018 the US and UK governments attributed the attack to the Russian military. The White House called it "the most destructive and costly cyber-attack in history," which "quickly spread worldwide, causing billions of dollars in damage across Europe, Asia, and the Americas."
03The second bill: insurance
Several victims then had to fight for their insurance. Insurers argued that a state-attributed attack fell under the "act of war" exclusion. Merck, which was reported to have suffered about $1.4 billion in losses, won in New Jersey courts in 2023, which found the exclusion covered traditional warfare, and settled with its insurers in January 2024, more than six years after the attack.
04Maersk terminals reported disrupted
| Region | Locations reported |
|---|---|
| Europe | Rotterdam, Netherlands; Spain |
| Africa | Morocco |
| Asia | Mumbai (JNPT), India |
| South America | Brazil; Argentina; Lima, Peru |
| North America | Los Angeles; Elizabeth, New Jersey |
As reported by Voice of America, June 30, 2017. Locations named in Maersk's update at the time; not a complete list.
05Reported cost of NotPetya to selected companies
| Company | Headquarters | Reported cost ($M) | Basis |
|---|---|---|---|
| Merck & Co. | United States | ≈1,400 | Losses as reported in coverage of its insurance litigation |
| FedEx (TNT Express) | United States / Netherlands | 400 | SEC filing, first half of fiscal 2018 |
| A.P. Moller-Maersk | Denmark | 200–300 | Company estimate, Q2 2017 interim report |
| Reckitt Benckiser | United Kingdom | 136 | £100M company estimate, converted at the time of reporting |
| Nuance Communications | United States | 90 | Company estimate |
US dollars, millions, as each company or its reporting disclosed. Maersk reported a range. Figures use different bases (lost revenue, costs, or total losses) and are not strictly comparable. Saint-Gobain (France) separately estimated less than €250 million in lost sales and €80 million in lost operating income for 2017.
What it shows
You can be collateral damage
None of these companies was the main target. Operating in, or connecting to, a country in conflict brought the conflict into their networks.
Trusted software is an entry point
The malware arrived through a legitimate vendor's update channel. A supplier's compromise became every customer's compromise.
Known vulnerabilities are the accelerant
A patch for the vulnerability that let NotPetya spread had been available since March 2017. Unpatched systems turned a local infection into a global one.
Recovery and insurance are not guaranteed
Recovery took weeks of manual work, and some insurers disputed claims for years on the grounds that the attack was an act of war.
Where Acervus applies
- Exposure Assessment and Monitoring watches an organization, its subsidiaries, and its portfolio companies from the outside for known exploited vulnerabilities, exposed remote access, and stolen credentials, the conditions that let an infection spread.
- Cyber Incident Response directs containment and eradication when an incident is underway, alongside the client's own IT staff.
- Custom Solutions address supplier and geographic exposure for clients with operations in, or dependencies on, regions in conflict.
Our experience
Acervus has applied its Investigative Analytics and Custom Solutions to matters of this kind for past clients. Client work is confidential. Examples are available to vetted clients on request.
Acervus was not involved in the events described in these case studies, which are drawn entirely from public reporting.
Request a consultationNext: Wirecard (2020)
Prefer to read offline? Open the case studies PDF (8 pages) or download it.
Sources
Publications as listed in the Acervus case studies document. Links are provided where the exact publication was located; other citations are given as listed. Titles and dates are as cited; consult the original publications for full context.
- Voice of America, "Companies Still Hobbled From Fearsome Cyberattack," June 30, 2017 (64 countries per Microsoft; terminals; Heritage Valley; FedEx trading halt). Online: Voice of America article (opens in a new tab)
- The Bulletin of the Atomic Scientists, "The worst cyberattack so far," August 2018 (more than $10 billion in total damage). Online: Bulletin of the Atomic Scientists article (opens in a new tab)
- Help Net Security, "NotPetya aftermath: Companies lost hundreds of millions," August 17, 2017 (Maersk; Saint-Gobain). Online: Help Net Security article (opens in a new tab)
- SecurityWeek, "Maersk Reinstalled 50,000 Computers After NotPetya Attack," January 2018 (Snabe figures).
- SecurityWeek, "NotPetya Attack Had Significant Impact on Merck Revenue," October 2017; Infosecurity Magazine, "Merck Settles With Insurers Over $700m NotPetya Claim," January 8, 2024.
- The Security Ledger, "NotPetya's Cost to FedEx: $400 Million and Counting," December 22, 2017; The Register, NotPetya anniversary, June 27, 2018 (Reckitt Benckiser); SecurityWeek, "Nuance Estimates NotPetya Impact at $90 Million."
- eWeek, "U.S. Formally Accuses Russia of Launching NotPetya Ransomware Attack," February 2018 (White House and UK statements).