2017 · Destructive attack

NotPetya, 2017: the update that cost ten billion dollars

Case file · 5 min read · Published 14 September 2026

People affected: No data stolen — an estimated $10 billion in destroyed systems
When it happened: 27 June 2017
Made public: 27 June 2017
How they got in: Compromised update server for M.E.Doc, Ukrainian tax accounting software, then automatic spread using EternalBlue and stolen credentials
Attributed to: Russia's GRU (Sandworm), attributed by the UK, US and allies in February 2018; six officers indicted by the US in October 2020
What it cost: ~$10 billion globally. Maersk ~$300m, Merck ~$870m, FedEx's TNT ~$400m, Mondelez ~$188m

On 27 June 2017, accountants across Ukraine opened their tax software and it updated itself, as it had a hundred times before. Within hours, shipping terminals in India stopped moving containers, a chocolate factory in Australia stopped making chocolate, and hospitals in Pennsylvania could not access patient records. Nothing was stolen. That was never the objective.

What happened

M.E.Doc is accounting software used by most Ukrainian companies to file tax returns. For a business operating in Ukraine it is effectively mandatory, which makes its update server one of the most efficient distribution points into the country's economy that exists.

Attackers compromised that update server and pushed a malicious update. On execution the payload did three things in quick succession: it harvested credentials from the memory of the machine it was on, it scanned the local network, and it spread — using the EternalBlue exploit against unpatched systems, and using the credentials it had just stolen to log into patched ones through Windows' own remote administration tools.

That last mechanism is what made NotPetya different from WannaCry six weeks earlier. WannaCry stopped at patched machines. NotPetya did not need an exploit if it had a password, and on a typical corporate network a domain administrator's credentials sitting in memory on one machine are a key to thousands. Organisations that had patched properly were still taken down in minutes.

Then it overwrote the master boot record and displayed a ransom demand.

The ransom note was a lie, and the lie was detectable. Researchers pulled it apart within a day. The installation key displayed on screen was random data rather than anything derived from the encryption, so the attackers could not have decrypted a victim's disk even if they had wanted to. Payment ran through a single hardcoded email address, which the provider suspended almost immediately — a detail no functioning criminal operation would design in. This was a wiper wearing a ransomware costume, and the costume bought it several days of being reported as an ordinary crime wave.

The companies that were not the target

NotPetya was aimed at Ukraine. It reached everyone else because multinational companies run flat global networks, and any of them with a Ukrainian subsidiary — a sales office, a small logistics arm, one finance team filing local taxes — had a machine running M.E.Doc connected to the rest of the business.

Maersk, the world's largest container shipping line, lost around 45,000 PCs and 4,000 servers. Terminals stopped operating. The loss was put at roughly $250–300 million.
Merck, the pharmaceutical company, reported damage of around $870 million, including lost production of a vaccine.
FedEx subsidiary TNT Express was hit for roughly $400 million and took months to restore full service.
Mondelez, owner of Cadbury and Oreo, reported around $188 million and lost 1,700 servers and 24,000 laptops.
Saint-Gobain, Reckitt Benckiser, Rosneft and Ukraine's own banks, metro and airport systems were all affected. So was the radiation monitoring at Chernobyl.

The White House put total damage at more than $10 billion. It remains the most expensive cyberattack ever recorded, and no personal data was taken in it.

The domain controller in Ghana

The most-repeated detail of the Maersk recovery is also the most instructive. The company's Active Directory — the database that holds every account and permission — was destroyed on every domain controller it had, worldwide, near-simultaneously. Without it, restoring anything else was pointless: there would have been no way to authenticate to the restored systems.

A single surviving copy was found in Ghana, where a power cut had taken the office offline before the malware arrived. Maersk's chairman described the recovery publicly the following year. The backup that saved a global shipping line was an accident of the local electricity supply.

The reason this story gets told is not the luck. It is that Maersk's backup strategy was, on paper, sound, and it still did not account for the possibility that everything would be destroyed at the same moment. Backups that are online and reachable from the network being destroyed are not backups. They are copies.

The timeline

April – June 2017 — Attackers hold access to the M.E.Doc update infrastructure and stage the payload.
27 June 2017 — The malicious update ships. Global spread takes hours.
28 June 2017 — Researchers establish that decryption is impossible and the ransom is a fiction.
July – December 2017 — Affected multinationals rebuild; the first loss figures appear in quarterly filings.
February 2018 — The UK, US, Australia, Canada, New Zealand and Denmark jointly attribute the attack to the Russian military.
October 2020 — The US indicts six GRU officers over NotPetya and related operations.
2022 – 2024 — The insurance disputes settle, Mondelez in 2022 and Merck in January 2024.

What it changed

Cyber insurance was rewritten. The war exclusion arguments failed on the wording that existed in 2017, and insurers responded by writing new wording. State-backed attack clauses are now explicit, negotiated, and frequently the most contested part of a cyber policy.

Flat networks became indefensible in practice, not just in theory. Segmentation had been recommended for years and widely ignored because it is expensive and inconvenient. NotPetya demonstrated the alternative cost in a single afternoon, and network segmentation moved onto board agendas.

Offline backups came back. A generation of IT teams had quietly moved to backup systems that were always connected because it was easier. Immutable and air-gapped backups returned as a standard requirement, and ransomware crews' habit of deleting backups first has kept them there.

The blast radius of a small subsidiary got taken seriously. Several victims had almost no Ukrainian business at all. Acquisition due diligence and subsidiary network isolation are now routine questions precisely because of this event.

What to take from it

Keep at least one backup the network cannot reach. Offline, immutable, or held by a third party — the test is whether an attacker with full administrator rights could destroy it.
Patching is necessary and not sufficient. NotPetya spread to fully patched machines using valid credentials. Limiting where administrator accounts can log in matters as much as keeping software current.
Know what would happen if your directory service vanished. Most organisations have never tested restoring it, and most recovery plans quietly assume it survives.
For individuals: a ransom screen is not proof there is a key. Paying never guarantees recovery, and in this case it could not have delivered it. A current offline backup is the only reliable answer.

Questions people ask

Was NotPetya ransomware?

It was designed to look like ransomware and was not one. Real ransomware needs a working payment and decryption path, because a crew that never returns files stops being paid. NotPetya overwrote the key material it claimed to be holding and used a single hardcoded contact address that the email provider shut down within hours. Recovery was never on offer. The ransom screen was camouflage for a destructive weapon.

Was any data stolen in NotPetya?

No. This is the unusual thing about it. Nothing was exfiltrated and nobody was blackmailed with leaked files. The entire cost came from destroyed machines, lost production and the months of rebuilding — which is why it remains the most expensive cyber incident on record despite exposing no personal data at all.

How did NotPetya spread so fast?

It used three methods at once: EternalBlue, the leaked NSA exploit for a Windows file-sharing flaw; EternalRomance, a related exploit; and credential theft from the memory of each machine it reached, which let it log into other machines legitimately using Windows' own administration tools. That third method is why patched machines still fell. A fully updated computer will still accept a valid administrator password.

Did insurance cover NotPetya losses?

Not without a fight. Insurers initially refused several of the largest claims by invoking war exclusions, arguing a state attack was an act of war. Mondelez settled with Zurich in 2022 and Merck settled in January 2024, after a New Jersey appellate court ruled that the exclusion did not apply to a cyberattack on this wording. Policies have been rewritten since with explicit state-actor clauses.

Sources

UK National Cyber Security Centre — attribution statement, 15 February 2018
US Department of Justice indictment of six GRU officers, October 2020
A.P. Moller-Maersk 2017 interim and annual reports — the source of the ~$250–300m loss figure
Merck & Co. securities filings and the New Jersey insurance litigation record