Risk register · entry
Q3 · EngineeredNotPetya (Maersk)
A Ukrainian tax update froze a fifth of world shipping. One server in Ghana had lost power and survived.
Tightly coupled systems where one small fault cascades and takes down the whole machine.
Why this room
NotPetya is a q3 case because the damage mechanism was coupling, not targeting: the malware entered through the trusted auto-update channel of a single Ukrainian accounting package (MeDoc) and then propagated automatically across flat, mutually-trusting Windows networks, so an infection in one Ukrainian tax client became a global outage in a firm that was never an intended target. Maersk's redundancy was correlated rather than independent, its synchronised domain controllers were designed to back each other up and were therefore wiped together, which is the classic engineered-system failure mode in which the safety design becomes the propagation path. The blast radius was set by the tightness of the coupling (76 port terminals halted, 45,000 endpoints destroyed) rather than by any decision an attacker made about Maersk.
The record
- Maersk put its own losses from the June 2017 NotPetya attack at USD 250-300 million; its first public guidance, given by CEO Soren Skou on 16 August 2017, was a negative results impact of USD 200-300 million.high
- The attack forced Maersk to halt operations at 76 port terminals worldwide, hitting Maersk Line, APM Terminals and Damco.certain
- Maersk reinstalled 4,000 servers, 45,000 PCs and 2,500 applications in ten days, work chairman Jim Hagemann Snabe said would normally take six months.certain
- Maersk kept running manually through the outage and took only a roughly 20 per cent drop in volumes.high
- The White House stated on 15 February 2018 that the Russian military launched NotPetya, 'causing billions of dollars in damage across Europe, Asia, and the Americas'; the widely-cited global figure of more than USD 10 billion is an estimate attributed to then-Homeland Security Adviser Tom Bossert, not a figure published by the White House.medium
Sources
The book
This entry is one of 111 in the register. The full story, and what it cost the people who lived it, is in Risky Business by Claudia Zeisberger, David Munro and Joanna Reijgersberg-Siew.
Join the waiting list