In 2017 a destructive worm aimed at Ukraine reached Maersk through a tax software update. No ship or crane was touched. Terminals still lost the systems that direct them, and staff moved cargo by hand.
NotPetya settles an argument about targeting. Maersk was not the target. The UK government says the primary targets were Ukrainian financial, energy and government sectors, and that the worm's indiscriminate design carried it further. It arrived through a Ukrainian office's tax software. What decided the size of the event was reach: a global directory let a great many machines see a great deal.
The ships were never touched. Terminals stopped anyway, because the systems that tell cranes what to move lived on the same trusted estate as the office. Two things kept it from being worse, and neither was a security control: one directory copy survived because it happened to be offline, and people with paper and phones kept volume moving. BlastWave's reading, which is analysis and not anything Maersk has said, is that separating the yard from the office directory would have made a global outage local.
What is not known: Maersk has never published a technical account of how the malware crossed its network, and no government statement attributing the attack names Maersk. Its figure is an effect on profitability, not an itemised bill. The famous server and PC counts come from its chairman on a panel; later reporting gives different ones. Where the surviving domain controller sat is disputed: Ghana in a reconstruction from unnamed staff, Lagos in reporting on an executive's talk. How many terminals stopped, and for how long, is undisclosed.
Recommendation
Take the path away from the yard Terminal operating and gate systems sit in their own compartment, reachable from the business network only through a controlled gateway, never through its directory.
Remove standing credential-based trust No single domain, administrator credential or management tool reaches both the office and operations. A credential harvested in the office opens nothing in the yard.
Make read-only consumers read one way Business systems receive terminal data one way, so the yard keeps its own data when the office goes dark, and the manual path has something to work from.
Sources: Maersk announcement, 28 Jun 2017; Maersk Interim Reports Q2 and Q3 2017; UK FCO and White House statements, 15 Feb 2018; Cisco Talos, The MeDoc Connection, 5 Jul 2017; US-CERT TA17-181A, 1 Jul 2017. Full list with links.
Soft Spots: USD 250-300m is an effect on profitability, not a repair bill or pure lost revenue. The 80 percent manual figure is the chairman's panel remark. That separating the yard from the office directory would have localised it is our analysis.
The full record
Every claim numbered to its source. Last updated .
A destructive worm aimed at Ukraine reached the world's largest container line through a tax software update, and its terminals lost the systems that direct them. What is verified, what is only reported, and what is still unknown.
Summary
In June 2017 NotPetya, a destructive worm aimed at Ukraine, reached A.P. Moller Maersk through a backdoored Ukrainian tax software update. Maersk was collateral damage, not the target. Its container businesses' IT went down and terminals in a number of ports were impacted, but Maersk said its vessels stayed maneuverable. Maersk put the effect on profitability at USD 250-300m.1,2,3,6
Timeline of NotPetya at Maersk
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Backdoored updates to M.E.Doc, Ukrainian tax accounting software, are distributed, according to Cisco Talos.11
Maersk is hit as part of a global cyber attack. Cisco Talos publishes its first analysis the same day, naming M.E.Doc update systems and propagation through EternalBlue, EternalRomance, WMI and PsExec.1,10
Maersk announces that IT systems are down across multiple sites and select business units, that its vessels are maneuverable, able to communicate and crews safe, and that APM Terminals is impacted in a number of ports. The malware is contained the same day. At Jawaharlal Nehru Port (JNPT) in India, a senior port official tells PTI that operations at the Maersk-run GTI terminal have come to a standstill and staff are trying to work manually; at Aarhus, the terminal manager tells Reuters it has found a way to work outside the Maersk network.1,2,18,19
Maersk resumes taking bookings from existing customers.2
Maersk's operations gradually progress to more normalized operations, by its own account.2
ESET publishes its analysis of the backdoor in a legitimate M.E.Doc module. Talos publishes "The MeDoc Connection", assessing with high confidence that the intent was destructive.11,12
Maersk's Q2 2017 interim report estimates a negative result impact of USD 200-300m, the majority lost revenue in July, and states the malware was distributed through M.E.Doc.2
Maersk's Q3 2017 interim report narrows the figure: "The effect on profitability from the June cyber-attack was USD 250-300m".3
At the World Economic Forum in Davos, Maersk chairman Jim Hagemann Snabe describes the rebuild and the manual workaround, as reported by Computing.14
The White House and the UK government attribute NotPetya to the Russian military. Neither statement names Maersk.6,7
Wired publishes a reconstruction placing the one surviving domain controller in Ghana, offline after a blackout, and counting 17 of Maersk's 76 terminals affected.15
CSO Online reports a talk by Maersk's technology and security chiefs; in the reporter's words the surviving copy was in Lagos, Nigeria, after a power cut.16
The Council of the European Union sanctions the GRU's Main Centre for Special Technologies (GTsST), field post number 74455, for the attacks publicly known as NotPetya.8
The US Justice Department announces charges against six GRU officers of Unit 74455. Maersk is not among the victims the release names. The charges are allegations.9
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
Was Maersk the target?
No. The UK government says the primary targets were Ukrainian financial, energy and government sectors6
Verified
How did the malware get in?
Through M.E.Doc, Ukrainian tax accounting software (Maersk); backdoored updates documented by Talos and ESET2,11,12
Verified
Through which machine?
One computer in the Odessa office, in Wired's reconstruction; not a Maersk statement15
Reported only
Were ships, cranes or control systems compromised?
None on the record. Vessels "maneuverable, able to communicate" (Maersk, 28 June 2017)1
Verified (on the record as read)
Who was responsible?
The Russian military, per the White House and the UK government, 15 February 20186,7
Verified (government attribution)
Which unit?
GRU GTsST, field post 74455, per EU sanctions and a US indictment; six officers charged, not convicted8,9
Verified (allegation)
What figure did Maersk disclose?
USD 250-300m, labeled an "effect on profitability", not an itemized cost3,4
Verified
Is there an itemized cost?
Not published. The figure covers "among other things" lost revenue, IT restoration and extra operating costs5
Undisclosed
How much cargo moved by hand?
About 80% of volume, per the chairman on a panel, as reported14
Reported only
How many terminals stopped, and for how long?
Maersk: "a number of ports". Wired counts 17 of 76. Durations undisclosed1,15
Undisclosed
Where did the surviving domain controller sit?
Ghana (Wired, 2018) or Lagos (CSO Online, 2019). No Maersk document names either15,16
Contested
When did operations return toward normal?
Contained 28 June; bookings 29 June; gradual progress to more normalized operations 3 to 9 July 2017 (Maersk)2
Verified
Did NotPetya hit Maersk's ships, cranes or port control systems?
Nothing on the record says the malware reached a ship, a crane or any control system. Maersk's announcement the day after the attack went out of its way to say so about its fleet:
"Maersk Line vessels are maneuverable, able to communicate and crews are safe. APM Terminals is impacted in a number of ports."
Terminals stopped anyway, because the IT systems that direct them were gone: partly wiped by the malware and partly shut down as a precaution. Maersk's Q2 2017 interim report says systems at Maersk Line, APM Terminals and Damco "had to be shut down for a period for precautionary measures, as they have global interfaces across businesses and partners," while six of its nine businesses, including all energy businesses, "could uphold normal operations."2 On the consequence ladder this is an IT compromise halting physical operations, untargeted and collateral.
Contemporaneous port reports show what that looked like on the ground. India's Ministry of Shipping confirmed one terminal at JNPT was affected, and a senior JNPT official told PTI that operations at the Maersk-run GTI terminal "have come to a standstill" and "They are trying to work manually."18At Aarhus, terminal manager Steen Davidsen told Reuters: "It's not quite so fast, but at least we can operate and customers can be serviced."19APM Terminals said "Impacted terminals have implemented business continuity plans," as reported by Maritime Executive.20
How many terminals stopped is not something Maersk has said. The count of 17 of Maersk's 76 terminals is Wired's, from its August 2018 reconstruction.15
How did NotPetya get into Maersk?
Through a backdoored update to M.E.Doc, an accounting package Maersk's Ukrainian operation used to file taxes. Maersk's own Q2 2017 report says the malware was "distributed through a Ukrainian accounting software called MeDoc."2 Cisco Talos documented backdoored updates on 14 April, 15 May and 22 June 2017.11 ESET found the backdoor in a legitimate M.E.Doc module and called it "a thoroughly well-planned and well-executed operation."12
Once inside a network it moved the way an administrator moves. Talos lists the SMB exploits EternalBlue and EternalRomance, plus WMI and PsExec using harvested credentials, and found no external scanning component: it spread to whatever each infected machine could reach.10 It presented itself as ransomware, but Talos assessed with high confidence that the intent was "destructive in nature and not economically motivated."11
The detail that it entered Maersk through a single computer in the Odessa office is Wired's reconstruction, from sources Wired says mostly would not be named.15 Maersk has published no technical account of how the malware crossed its network. Accounts of unpatched and legacy systems also rest on unnamed sources; Gavin Ashton, who worked on identity and access management at Maersk, wrote that patching "would absolutely have helped."15,17
Who was behind NotPetya, and was Maersk the target?
The US and UK governments attributed NotPetya to the Russian military on 15 February 2018, and the UK named Ukraine, not Maersk, as the target.
"Primary targets were Ukrainian financial, energy and government sectors. Its indiscriminate design caused it to spread further"
"In June 2017, the Russian military launched the most destructive and costly cyber-attack in history."
Each document speaks at its own grain. The 2018 statements say "the Russian military" and name no unit. The Council of the European Union's sanctions listing of 30 July 2020 names the GRU's Main Centre for Special Technologies (GTsST), field post number 74455, for the attacks "publicly known as 'NotPetya' or 'EternalPetya' in June 2017."8 The US indictment announced on 19 October 2020 charges six GRU officers and cites "Sandworm Team" as one of several researcher labels; the Justice Department notes that "The charges contained in the indictment are merely accusations."9 The officers are charged, not convicted, and Maersk is not among the victims the release names. None of these statements names Maersk. This actor is a different Russian organization from the one behind Triton.
How much did NotPetya cost Maersk?
Maersk's own figure is a USD 250-300m effect on profitability, not an itemized cost. The figure was disclosed in three steps, and the label is part of it.
16 August 2017, Q2 interim report. "We expect that the cyber-attack will impact results negatively by USD 200-300m," the majority of it lost revenue in July.2
7 November 2017, Q3 interim report. The range narrows to a USD 250-300m effect on profitability, "of which the vast majority relates to temporary lost business in July and August."3
Annual Report 2017. Three labels for the same range: an effect on profitability, an impact on underlying profit, and, once, "a cost of approx. USD 250-300m."4
"The effect on profitability from the June cyber-attack was USD 250-300m, with the vast majority of the impact related to Maersk Line in Q3."
Maersk's 2017 risk management report describes "losses in the order of USD 250-300m covering, among other things, loss of revenue, IT restoration costs and extraordinary costs related to operations."5 So it is neither a repair bill nor pure lost revenue. The Q3 report's sentence about "additional IT costs, a general business impact and loss in productivity" sits in its Damco section and describes Damco only.3 No Maersk document we read puts the figure above USD 300m.
How did Maersk recover, and where was the domain controller that survived?
By rebuilding its IT and moving cargo by hand in the meantime, helped by one copy of its directory that survived because it happened to be offline. The best-known counts come from Maersk's chairman at Davos in January 2018, as reported:
"We had to install 4,000 new servers, 45,000 new PCs, 2,500 applications"
Snabe called it "a heroic effort over ten days" and said: "We only had a 20 per cent drop in volume, so we managed 80 per cent of that volume manually."14 Those are panel remarks, not filings. Reporting on a 2019 talk by Maersk's chief technology officer gives different counts, about 49,000 devices and 1,200 critical applications, in the reporter's paraphrase.16 Every count belongs to a speaker.
Where the surviving domain controller sat is disputed. Wired's 2018 reconstruction places it in Ghana, kept offline by a blackout, with Maersk's executives having "declined to comment in any official capacity."15 CSO Online's 2019 report of the executives' conference talk places it in Lagos, Nigeria, after a power cut, in the reporter's words.16 No Maersk document names either. Both agree on the shape: one copy survived because it was offline, by accident. Ashton wrote: "By rights, the directory should have been gone," and "we were incredibly lucky."17
Maersk then spoke in public, with numbers. Snabe said at Davos, "We were basically average when it comes to cyber-security, like many companies."14 In 2019 the chief technology officer said "Maersk was not unusually weak," and the chief information security officer said "Transparency is everything."16
What is still not known about NotPetya / Maersk
How the malware crossed Maersk's network. Maersk has published no technical account.
How many terminals stopped, and for how long. Maersk said "a number of ports"; the count of 17 of 76 is Wired's.1,15
An itemized cost. Maersk's figure is an effect on profitability.3,5
Where the surviving domain controller sat: Ghana in a reconstruction from unnamed staff, Lagos in reporting on an executive's talk.15,16
The exact device and application counts. The chairman's panel figures and the 2019 reported figures differ, and neither is a filing.14,16
The exact date of the chairman's Davos remarks: the World Economic Forum's photo record dates the session to 23 January 2018, and some reports say 24 January.
Claims about NotPetya / Maersk the record does not support
Widely repeated claim
What the record says
"Port control systems survived largely because of luck."
No source. Nothing on the record says the malware reached a crane, a vessel or any control system; terminal IT was partly wiped and partly shut down as a precaution.1,2
"A domain controller in Ghana, knocked offline by a blackout, saved Maersk."
Wired's 2018 reconstruction from mostly unnamed sources. A 2019 report of an executive's talk says Lagos. No Maersk document names either.15,16
Including our own. Our Volume 1 Maersk blog got several things wrong. It stated the Ghana blackout as fact, said port control systems survived "largely because of luck" with no source, and attributed a Maersk executive's quote to the chief information security officer when the reporting attributes it to the chief technology officer. All are corrected here.15,16 We correct our own record first; it is what earns the right to correct anyone else's.
BlastWave analysis: the hole was not the finding
Analysis, not a disclosed fact
NotPetya settles an argument the industry keeps having about targeting. Maersk was not the target. It arrived through an accounting package a Ukrainian office used to file taxes, and no threat intelligence about shipping would have predicted that door. What decided the size of the event was reach: once inside, the worm used stolen credentials and ordinary administration tools to go wherever a machine could see, and a global directory let a great many machines see a great deal. Terminals stopped because the systems that tell cranes what to move and trucks where to go lived on the same trusted estate as the office.2,6,10
Two things kept it from being worse, and neither was a security control: one copy of the directory survived because it happened to be offline, and people with paper and phones kept most of the volume moving. Maersk then did what few victims do and stood up in public, with numbers; disclosure has been measured against it since. BlastWave's reading, which is analysis and not anything Maersk has said, is that separating the systems that gate the yard from the office directory would have turned a global outage into a local one.14,15,16
Podcast: “Watertight Bulkheads” (9:17). Joe Baxter and Cam Cullen on why the hole was not the finding: how far the water got, and whether anyone had drilled the manual fallback.
Video: NotPetya / Maersk Short (60 to 90 seconds).
Frequently asked questions
What happened to Maersk in the NotPetya cyberattack?
On 27 June 2017, A.P. Moller Maersk was hit by NotPetya, a destructive worm spread through a backdoored update to Ukrainian tax software. Maersk said the next day that IT systems were down across multiple sites, that APM Terminals was impacted in a number of ports, and that its vessels were maneuverable. Its chairman later said, as reported, that about 80 percent of volume was handled manually, and operations gradually normalized from 3 to 9 July.
Was Maersk the target of NotPetya?
No government statement says so. The UK government said on 15 February 2018 that the primary targets were Ukrainian financial, energy and government sectors and that the malware's indiscriminate design caused it to spread further. Maersk was reached because its Ukrainian operation used M.E.Doc, the tax accounting software whose update channel carried the malware. None of the US, UK or EU attribution documents names Maersk.
Did NotPetya affect Maersk's ships or cranes?
Nothing on the record says so. Maersk said on 28 June 2017 that its vessels were maneuverable, able to communicate and crews safe. Terminals stopped because the IT systems that direct cranes and gates were partly wiped and partly shut down as a precaution. No primary record describes a compromise of a vessel, a crane or any operational control system.
How much did NotPetya cost Maersk?
Maersk reported a USD 250-300m effect on profitability in its Q3 2017 interim report of 7 November 2017 and its Annual Report 2017. Its first estimate, on 16 August 2017, was USD 200-300m, the majority lost revenue in July. Maersk labels the figure an effect on profitability, not an itemized cost, and no Maersk document we read puts it above USD 300m.
How did NotPetya get into Maersk's network?
Maersk's Q2 2017 report says the malware was distributed through M.E.Doc, Ukrainian accounting software. Cisco Talos documented backdoored M.E.Doc updates in April, May and June 2017, and ESET found the backdoor in a legitimate software module. The detail that it entered through a single computer in Maersk's Odessa office comes from Wired's 2018 reconstruction, not from Maersk.
Who was behind NotPetya?
The White House and the UK government said on 15 February 2018 that the Russian military was responsible. EU sanctions in July 2020 named the GRU's Main Centre for Special Technologies, field post 74455, and the US Justice Department charged six GRU officers in October 2020. The officers are charged, not convicted. Sandworm is a researcher label, not a government finding.
Where was the Maersk domain controller that survived NotPetya?
It is disputed. Wired's August 2018 reconstruction, from mostly unnamed sources, places it in Ghana, offline because of a blackout. CSO Online's October 2019 report of a Maersk executives' conference talk places it in Lagos, Nigeria, after a power cut. No Maersk document names either location. Both accounts agree that one copy survived because it was offline by accident.
Primary sources are A.P. Moller Maersk's own announcements and financial reports, government and sanctions documents, and the responders' own technical publications. Press and personal accounts are cited as evidence of what was said, each with its speaker.
CompanyA.P. Moller Maersk, company announcement, "Cyber attack update," 28 June 2017. investor.maersk.com
Company filingA.P. Moller Maersk, Interim Report Q2 2017, 16 August 2017 (CEO statement, guidance and cyber-attack section). PDF · Announcement
Company filingA.P. Moller Maersk, Interim Report Q3 2017, 7 November 2017. PDF
Company filingA.P. Moller Maersk, Annual Report 2017. PDF
Company filingA.P. Moller Maersk, Risk Management report 2017. PDF
GovernmentUK Foreign and Commonwealth Office, "Foreign Office Minister condemns Russia for NotPetya attacks," 15 February 2018 (including the National Cyber Security Centre assessment in its notes to editors). gov.uk
FederalThe White House, "Statement from the Press Secretary," 15 February 2018. archives
GovernmentCouncil of the European Union, cyber sanctions listing of 30 July 2020 under Regulation (EU) 2019/796, Implementing Regulation (EU) 2020/1125 (GRU Main Centre for Special Technologies, GTsST, field post number 74455). eur-lex.europa.eu
FederalUS Department of Justice, "Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware," 19 October 2020. justice.gov
ResearcherCisco Talos, "New Ransomware Variant 'Nyetya' Compromises Systems Worldwide," 27 June 2017, updated 6 July 2017. talosintelligence.com
ResearcherCisco Talos (Maynor, Olney, Younan), "The MeDoc Connection," 5 July 2017. talosintelligence.com
ResearcherAnton Cherepanov, ESET, "Analysis of TeleBots' cunning backdoor," WeLiveSecurity, 4 July 2017. welivesecurity.com
PressTom Allen, Computing, report of Jim Hagemann Snabe at the World Economic Forum session "Securing a Common Future in Cyberspace," Davos, 26 January 2018. Cited as evidence of what was said. computing.co.uk
PressAndy Greenberg, "The Untold Story of NotPetya, the Most Devastating Cyberattack in History," Wired, 22 August 2018. Cited as evidence of what was said. wired.com
PressDan Swinhoe, "Rebuilding after NotPetya: How Maersk moved forward," CSO Online, 9 October 2019, reporting Adam Banks (CTIO) and Andy Powell (CISO) at the Gartner Security and Risk Management Summit, London. Cited as evidence of what was said. csoonline.com
ResearcherGavin Ashton, "Maersk, me & NotPetya," personal blog, 21 June 2020. A first-hand account by a member of Maersk's identity and access management team at the time of the attack. gvnshtn.com
PressPress Trust of India, report on operations at JNPT, via Business Standard, 28 June 2017. Cited as evidence of what was said. business-standard.com
PressReuters, via gCaptain, report on Maersk-operated port terminals, 28 June 2017 (Aarhus terminal manager Steen Davidsen). Cited as evidence of what was said. gcaptain.com
PressMaritime Executive, report quoting APM Terminals, June 2017 ("Impacted terminals have implemented business continuity plans"). Cited as evidence of what was said.
Cite this page
BlastWave. “Maersk and the NotPetya Cyberattack (2017): What Is Verified.” Hackopedia, Volume 2, FILE 002. Last verified 28 September 2026. https://hackopedia.blastwave.com/transportation-logistics/notpetya-maersk-2017/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 002 in Hackopedia Volume 2, in the Transportation and Logistics edition.
28 Sep 2026
Hand-check against the source: the chairman's Davos remarks as reported, Wired's reconstruction, a former employee's first-hand account, the Indian and Danish port reports and the US-CERT alert were read to confirm the quotations this page carries. The statement that JNPT staff were trying to work manually is attributed to a senior port official, not to India's Ministry of Shipping.
26 Sep 2026
Full validation of every quotation, date and figure against Maersk's announcement, its Q2 and Q3 2017 interim reports, its Annual Report 2017 and 2017 risk management report, and the government, sanctions and researcher documents. The make-up of Maersk's final figure is taken from its group guidance; a Q3 sentence about IT costs and lost productivity describes Damco only. The return to normal operations is described as gradual, as Maersk wrote it.
24 Sep 2026
Volume 2 entry built from primary sources. Corrected Volume 1 errors: the unsourced claim about port control systems, the Ghana location stated as fact, and a quote attributed to the wrong executive.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
