Ten Days Without Computers

On the afternoon of 27 June 2017, screens across the Copenhagen headquarters of A.P. Møller-Maersk began turning black, one after another, faster than anyone could walk between them. Laptops rebooted into ransom notes; phones tied to the network died; employees ran along corridors telling colleagues to pull cables out of the wall. Within a couple of hours the company had lost essentially its entire IT estate — figures later given ran to some forty-five thousand laptops and several thousand servers, unusable. Maersk at the time moved roughly one fifth of the world's seaborne containers. Its booking system was down. The gates at dozens of its port terminals — from New Jersey to Rotterdam to Mumbai — no longer knew which truck was allowed to collect which box.

Maersk had not been attacked. That is the first strangeness of the case. The weapon, later named NotPetya, had been seeded into the update mechanism of a piece of Ukrainian accounting software that almost every company operating in Ukraine was legally obliged to use. From there it spread laterally with leaked military-grade exploits, moving through corporate networks at machine speed. It looked like ransomware and displayed a payment demand; in reality it was a wiper — the encryption was irreversible by design. Paying was pointless. Anyone connected to Ukraine, from pharmaceutical giants to chocolate factories, was collateral damage in what governments later attributed to a state attack on another state.

Total damage across all victims was later estimated in official statements at around ten billion dollars — routinely described as the most costly cyber incident in history. Maersk's own share would come to roughly two hundred and fifty to three hundred million. But on the afternoon itself, nobody was counting money. The question in Copenhagen was more basic: a company that moves a fifth of world trade had, for practical purposes, no computers — and ships carrying thousands of containers were arriving at ports every few minutes, expecting instructions.

What happened over the following ten days is why this case is taught rather than merely cited. With the formal systems gone, the informal organisation surfaced. Terminal staff waved trucks through gates on judgement and handwritten lists. Bookings — normally thousands per hour through the online system — were taken down in personal notebooks and coordinated through WhatsApp groups and hastily created free email accounts. Veterans who remembered pre-digital processes suddenly became the most valuable people in the building. Through it all, remarkably, the ships themselves kept sailing: their operational systems were separate, and the cargo already aboard went where it was going. The company later reckoned it had operated at something like eighty per cent of normal volume through the blackout — on paper and improvisation.

Recovery, meanwhile, hit a wall that had been invisible until that week. Rebuilding the network required the directory system that holds every user, password and permission — and Maersk discovered that its domain controllers, the servers holding that identity core, had all been synchronised replicas of one another. All of them, in every country, had been destroyed together. The backups of everything else were useless without that foundation. Then someone found the exception: in the Lagos-adjacent office in Ghana, a single domain controller had been offline during the attack — knocked out by a local power cut. One unplanned blackout in West Africa had preserved the only surviving copy of the company's identity. The disk was flown to Britain — accounts of the journey have a relay of employees carrying it like a transplant organ — and became the seed from which the network was regrown.

The rebuild itself was done at a pace the industry still talks about: a temporary command centre in England, staff and contractors working around the clock, four thousand new servers and tens of thousands of machines reinstalled — the core rebuilt in about ten days, full recovery over months. Insurers, for their part, opened a second front: because governments had attributed NotPetya to a state, some carriers across the affected industries invoked war exclusions, and litigation over whether a state cyber weapon counts as "war" ran for years afterwards.

The aftermath produced one of the rarest artefacts in corporate life: genuine public candour. At Davos the following January, Maersk's chairman, Jim Hagemann Snabe, told the audience that the company's cyber security had been, in his word, average — and that the incident had taught him average was not good enough for a business the world's supply chains depended on. He described the ten-day rebuild, credited what he called heroic effort by employees, and drew the conclusion in public that most boards only whisper: the company had been lucky, and luck is not a control.

Internally, the incident did what a decade of security budget requests had not. Cyber risk moved from the IT department's slide deck to the board's agenda; the company invested heavily in segmentation, recovery capability and the unglamorous discipline of knowing what would break if something else broke. Industry-wide, NotPetya redrew the map: it demonstrated that the most dangerous attack is the one aimed at somebody else, that backups mean nothing if the thing they depend on has no offline copy, and that insurance language written for wars between armies fits badly onto wars between servers. Security professionals date a change in board behaviour from that summer.

The live question the case leaves is the one Snabe's candour raised and no one has settled. Maersk recovered because its people improvised brilliantly and because a power cut in Ghana happened at the right moment. Strip out the fluke, and the ten-day recovery might have been a ten-week one — an outcome later analyses suggested could have threatened the company's survival. Resilience, in other words, was demonstrated but not designed. Every organisation that studies this case has to answer for itself: how much of our own recovery plan is actually a plan — and how much of it is a Ghana we haven't identified yet?