A shipping giant lost its entire computer system to an attack aimed at someone else. A drug company faced demand that nobody could forecast. Both had to answer “what if?” with an honest range, and a plan.
← Ninety Days and Thirteen Thousand Bricks · The whole pathway · What if…? — the quick guide · Who Knew, and When? →
Ten items. Say your answer out loud before you reveal it.
Read the sentence, guess the meaning of the word in bold, then reveal.
Three terms: a worst-case scenario · early warning · a safety net. Say the right one, then reveal.
One missing word fits every phrase in the group. Say it, then reveal.
Read each part. After it, answer the quick check from memory, then discuss one question. The figures are rounded, and the facts are as the cases were reported.
You may have met this case in Ten Days Without Computers. This time, look at it through the lens.
On the afternoon of 27 June 2017, screens across the Copenhagen headquarters of the shipping company Maersk began turning black, one after another, faster than anyone could walk between them. Laptops rebooted into ransom notes. Employees ran along corridors telling colleagues to pull cables out of the wall. Within a couple of hours the company had lost essentially its entire IT estate: some forty-five thousand laptops and several thousand servers. Maersk then moved roughly one fifth of the world’s seaborne containers. Its booking system was down, and the gates at dozens of its port terminals no longer knew which truck should collect which box.
Maersk had not been attacked. That is the first strangeness of the case. The weapon, later named NotPetya, had been planted in an update to a Ukrainian accounting program that almost every company operating in Ukraine had to use. It looked like ransomware and displayed a payment demand, but in reality it was a wiper: the damage could not be undone and paying was pointless. Companies connected to Ukraine, from drug makers to chocolate factories, were collateral damage in what governments later attributed to a state attack on another state.
Total damage across all victims was later put at around ten billion dollars, routinely described as the most costly cyber incident in history. Maersk’s own share was roughly two hundred and fifty to three hundred million. But on the afternoon itself nobody was counting money. A company that moves a fifth of world trade had, in practice, no computers, and ships carrying thousands of containers were arriving at ports every few minutes, expecting instructions.
1. How much of Maersk’s IT was lost, and how fast?
2. Why does the case say ‘Maersk had not been attacked’?
3. Why was paying the ransom pointless?
1. Essentially all of it, within a couple of hours: about forty-five thousand laptops and several thousand servers.
2. Because the malware was planted in a Ukrainian accounting program that firms in Ukraine had to use, and spread to companies in many countries by accident. Maersk was collateral damage.
3. Because it was a wiper disguised as ransomware: the damage could not be undone, whatever was paid.
You may have met this case in Ten Days Without Computers. This time, look at it through the lens.
What happened over the next ten days is why the case is taught. With the formal systems gone, the informal organisation took over. Terminal staff waved trucks through gates on judgement and handwritten lists. Bookings were taken down in personal notebooks and coordinated through WhatsApp groups and free email accounts. People who remembered pre-digital processes suddenly became the most valuable in the building. The ships themselves kept sailing, because their operational systems were separate. The company later reckoned it had worked at something like eighty per cent of normal volume through the blackout.
Recovery hit a wall that had been invisible until that week. Rebuilding the network needed the directory system that holds every user, password and permission, and Maersk discovered that its domain controllers, the servers holding that core, were all replicas of one another. They had been destroyed together, in every country. Then someone found an exception: in an office in Ghana, a single domain controller had been offline during the attack, knocked out by a local power cut. One unplanned blackout in West Africa had preserved the only surviving copy. The disk was flown to Britain and became the seed from which the network was regrown.
The core was rebuilt in about ten days, with a temporary command centre, staff and contractors working around the clock, and four thousand new servers. Full recovery took months. The lesson most often taken is not that the attack could have been predicted. It is that the company had a single point of failure that nobody had listed, and was saved by luck, and by people who could still work without computers.
1. How did Maersk keep operating while the computers were down?
2. What was the hidden single point of failure, and what saved the company?
3. What is the lesson most often taken from the case?
1. By hand and by improvisation: handwritten lists, personal notebooks, WhatsApp groups and free email accounts, and staff who remembered paper processes. About eighty per cent of normal volume was reportedly handled this way.
2. All the domain controllers were replicas, so all were destroyed together. A single one in Ghana survived only because a local power cut had taken it offline during the attack.
3. That the company had a single point of failure nobody had listed, and was saved by luck and by people who could still work without computers; not that the attack could have been predicted.
You may have met this case in The Problem of Too Much Demand. This time, look at it through the lens.
A different company faced the opposite problem. Novo Nordisk, a century-old Danish maker of insulin, saw demand for its weight-loss and diabetes drugs, sold as Wegovy and Ozempic, rise faster than it could build factories. Injectable drugs cannot be scaled like software, and a new sterile filling line takes years to build and validate. The company ended up holding back launches in new countries and asking doctors, in effect, to stop creating new customers. It committed tens of billions of dollars to new plants, and a rival drug from Eli Lilly arrived with strong results. Through it all ran a strange question: how big is this market? Forecasts for the obesity-drug market by 2030 ranged from fifty billion dollars to a hundred and thirty billion, a spread so wide it amounted to a confession.
Use the lens. What could happen? At Maersk, the loss of every system together; at Novo, too little capacity, or too much. How likely, and how bad? The Maersk event was very unlikely and enormously damaging; Novo’s was likely in both directions. What would warn us? At Maersk, nothing did. At Novo, shortages and rival results were visible. What is our response? For Maersk, a prepared fallback, and a copy of the identity core kept apart. For Novo, plans for a range of futures rather than one number.
The lens will not make a surprise predictable. What it does is force the question that is usually skipped: what is the one thing that, if lost everywhere at once, would stop us from recovering? And it makes an honest answer to how big? sound like a range with a reason, not a single number defended too loudly.
1. Why could Novo Nordisk not simply build more factories at once?
2. What did the forecasts for the obesity-drug market in 2030 range between?
3. What question does the lens force that is usually skipped?
1. Injectable drugs cannot be scaled like software, and a new sterile filling line takes years to build and validate.
2. From about fifty billion dollars to about a hundred and thirty billion: a spread so wide it amounted to a confession.
3. What is the one thing that, if lost everywhere at once, would stop us from recovering?
A “What if…?” question asks you to think ahead: what could happen, and are we ready? The danger is that people list only the risks they can already picture. The lens makes you rate each one, name an early warning, and choose a response. It is a thinking aid: it will not make the unexpected predictable, but it makes your answer honest about what you do not know.
Each situation describes a risk and what could be done. Which response does the lens point to? Choose, then check.
1. Prepare for it — the hospital cannot stop an outage, but a plan B is ready and tested.
2. Prevent it — the cause is simple and cheap to remove, so the event can be stopped from happening at all.
3. Accept it — the risk is low and the cost of avoiding it is higher than the damage; the key is to say so knowingly.
4. Reduce it — the breach is not stopped, but the damage from each one is made smaller.
5. Prepare for it — it combines an early warning with a plan B.
6. Prevent it — removing the cause stops the event from happening at all.
7. Reduce it — it limits the damage if the event happens instead of stopping or planning around it.
False comfort from numbers. Ratings such as ‘low’ can hide guesses. Say how sure you are and what you do not know.
The risk nobody listed. A list of risks is a list of what people could imagine. Ask: what single thing, if lost everywhere at once, would stop us recovering?
Over-preparing. Not every risk deserves a plan. Accepting a small risk knowingly is a decision; ignoring it is not.
A good answer to a ‘what if’ sounds exactly as sure as you are. This language says how likely something is, gives a range instead of one number, and names the consequence.
Use each word or phrase from the box once: unlikely · event · chance · bound.
1. The supplier is to fail this winter; the probability is very small.
2. In the of an attack, staff will switch to paper at once.
3. There is a real that demand will double within a year.
4. In a system this large, something is to go wrong sooner or later.
1. unlikely — unlikely to + infinitive for a small probability
2. event — in the event of + noun
3. chance — a real chance that
4. bound — bound to for something almost certain
Write one word in each gap.
1. Estimates range fifty a hundred and thirty billion dollars.
2. Demand could be anywhere two and four million units.
3. Losses are expected to be the region of two hundred million.
4. The true figure is far likely to lie in the middle of the range than at either end.
1. from … to — range from… to…
2. between — between… and…
3. in — in the region of
4. more — more likely to lie… than…
Now describe a risk in your own work in four sentences: say what could happen, how likely and how bad it is, with a range and not a single number, and what the response is.
Say how likely, how bad, and what you would do. Choose a task, start the timer, and talk.
Choose one: What happens to a hospital if its main computer system fails for a week? What happens to a shop if its biggest customer leaves? What happens to a team if its most experienced person resigns? Say what could happen, how likely and how bad, an early warning, and your response.
Name a risk in an area you know that does not appear on most lists. Say why it is easy to miss, what single thing it could stop, and what would warn you.
Your partner asks: “How much will this cost?” Give a range with a reason, say what is most likely, and say what would push it to either end.