A shipping company that carried a fifth of the world's containers lost every computer it owned in two hours — and it was not even the target.
Harder version: read this lesson at C1 level →
Look at each word. Say what you think it means. Then tap the card.
Tap a card to see the meaning.
Write one word from the cards in each gap.
1. Always keep a of your photographs on a different device.
2. The fire caused a lot of to the roof.
3. The bad news through the office in five minutes.
4. He won the competition, but I think it was mostly .
5. She was ill for two weeks and then completely.
6. The ship was carrying eight thousand .
1. backup · 2. damage · 3. spread · 4. luck · 5. recovered · 6. containers
Read each part. Then answer the questions before you read the next part.
On the afternoon of 27 June 2017, screens started going black in the head office of Maersk in Copenhagen.
They went black one after another, faster than a person could walk between them. Laptops restarted and showed a message asking for money. Telephones connected to the network died. People ran along the corridors shouting at colleagues to pull the cables out of the wall.
In about two hours, the company lost almost every computer it had: around forty-five thousand laptops and several thousand servers.
Maersk carried about one fifth of all the containers in the world. Now its booking system was dead. At ports from New Jersey to Rotterdam to Mumbai, the gates did not know which lorry could collect which box.
And here is the strangest part of this story. Nobody had attacked Maersk.
The virus, later called NotPetya, had been hidden inside an update to a piece of Ukrainian accounting software. Almost every company working in Ukraine had to use that software by law. From there the virus spread by itself, at machine speed, through company networks.
It looked like a normal attack asking for money. It was not. It destroyed the information permanently, on purpose. Paying was pointless.
Anyone connected to Ukraine — medicine companies, chocolate factories, shipping lines — was simply in the way. Governments later said it was one country attacking another.
The total damage was about ten billion dollars: the most expensive computer attack in history. Maersk's share was around two hundred and fifty million.
But that afternoon, nobody was counting money. Ships full of containers were arriving at ports every few minutes, waiting for instructions.
True or false? Click your answer.
1. Maersk lost most of its computers in about two hours.
2. The attackers were trying to damage Maersk.
3. Companies could pay money and get their information back.
What happened in the next ten days is why people still teach this story.
The official systems were gone, so the unofficial company appeared. Staff at the port gates looked at lorries and decided with their own judgement, writing lists by hand. Bookings — normally thousands every hour through the website — were written in personal notebooks and organised through WhatsApp groups and free email accounts made that morning.
Older employees who remembered how the work was done before computers suddenly became the most important people in the building.
But to rebuild the network, the company needed one thing it did not have: a clean copy of its own directory — the system that knows who everybody is. Every copy had been destroyed.
Every copy except one.
In Ghana, a single server had been switched off during the attack, because of a local power cut. One unplanned blackout in West Africa had saved the only surviving copy of the company's identity.
The disk was flown to Britain. In the stories people tell, employees carried it by hand in a relay, like an organ for a transplant.
From that one disk, the network was grown again. A temporary command centre was set up in England. Staff and contractors worked day and night. Four thousand new servers and tens of thousands of machines were reinstalled.
The core was rebuilt in about ten days. Full recovery took months.
True or false? Click your answer.
1. Staff used handwritten lists and WhatsApp to keep working.
2. All copies of the company directory were destroyed.
3. The surviving server was safe because of a good security plan.
Afterwards, the chairman of Maersk did something unusual. He spoke about it in public, honestly.
He said the company's computer security had been "average" — and that average was not good enough for a company the world's trade depends on. He described the ten days, thanked the staff for extraordinary work, and then said the thing most boards only whisper.
The company had been lucky. And luck is not a control.
Inside Maersk, the attack did what ten years of security budget requests had not. Computer risk moved from a slide in the IT department to the top of the board's agenda. The company spent heavily on separating its networks, on being able to recover, and on the boring discipline of knowing what breaks when something else breaks.
Across the whole industry, the attack changed the map. It showed three things. The most dangerous attack may be one aimed at somebody else. A backup is worth nothing if it depends on the thing that just died. And insurance written for wars between armies fits badly onto wars between computers.
But the honest question is the one the chairman raised and nobody has answered.
Maersk recovered because its people improvised brilliantly — and because a power cut in Ghana happened at exactly the right moment. Take away that luck, and ten days might have been ten weeks. Some later analyses suggest ten weeks could have threatened the whole company.
The company proved it was strong. But it had not designed that strength.
So every company that studies this case has to ask itself one question. How much of our recovery plan is really a plan? And how much of it is a Ghana we have not found yet?
True or false? Click your answer.
1. The chairman said the company's security had been excellent.
2. After the attack, computer risk became a subject for the board.
3. Maersk had designed its recovery carefully in advance.
When you describe an incident, you need two past tenses working together. One for the background, one for the events.
Past continuous (was / were + -ing) = the longer situation, already happening. → "Staff were working normally."
Past simple = the short action that arrived. → "Then the screens went black."
Put them together with when and while: "Staff were working normally when the screens went black."
The rule that helps: while is usually followed by the long action (while they were working); when is usually followed by the short one (when the virus arrived).
| Tense | Use | Example |
|---|---|---|
| was / were + -ing | the background, in progress | Ships were arriving at the ports. |
| past simple | the event that happened | The system crashed. |
| while + past continuous | the long action | While staff were running down the corridor… |
| when + past simple | the short action | …when the screens went black. |
Put the verb in brackets into the past simple or the past continuous.
1. Staff (work) normally when the first screens went black.
2. While the network (die), employees ran along the corridors.
3. Ships (arrive) at the ports while the booking system was down.
4. The company (lose) forty-five thousand laptops in about two hours.
5. One server in Ghana (not work) during the attack, because of a power cut.
1. were working · 2. was dying · 3. were arriving · 4. lost · 5. was not working
Each sentence has one mistake. Say the correct sentence out loud, then check.
1. While the staff worked, the virus was spreading through the network.
2. The screens were going black at 2pm exactly.
3. When the system was crashing, everybody ran to the corridor.
4. They was working all night to rebuild the servers.
5. The disk arrived in Britain while somebody carried it by hand.
1. While the staff were working, the virus spread through the network. (after while, use the long action)
2. The screens went black at 2pm exactly. (an exact moment = past simple)
3. When the system crashed, everybody ran to the corridor. (after when, the short action)
4. They were working all night to rebuild the servers. (they takes were)
5. The disk arrived in Britain after somebody carried it by hand. (or: while somebody was carrying it)
Take your time. Short sentences are fine.
Tell me what happened at Maersk. Six or seven sentences is enough.
Tell me about a time when something you depend on stopped working — the internet, the electricity, your car, a system at work.
What did you do instead?
If your office lost every computer tomorrow morning, what would still work?
Who in your team would suddenly become the most important person?
Maersk was saved partly by luck. Should the chairman have said that in public?
What do people gain, and what do they lose, when a boss is that honest?