Ten days to rebuild a global operation
In June 2017, A.P. Møller-Maersk, one of the largest shipping and logistics operators on the planet, was hit by NotPetya, destructive malware that spread globally from a compromised legitimate software package widely used in Ukraine. According to public reports and the company's own statements, the infection took down corporate systems and paralyzed operations at dozens of port terminals, forcing teams to process cargo manually.
The company publicly reported that it had to rebuild practically its entire technology infrastructure, roughly 4,000 servers and 45,000 computers, in a concentrated effort of approximately ten days, as recorded by BleepingComputer. In a statement to investors, Maersk estimated the financial impact at between US$ 250 million and US$ 300 million, and the landmark Wired report on the episode describes 76 port terminals affected around the world.
The technical details of what happened inside the organization were never disclosed in depth, and no honest reading can state which specific systems failed or through which door the code got in. The value of the case for decision-makers lies in the public, auditable scale of the damage, with an intercontinental logistics operation running on pen and paper and a nine-figure number booked in the quarter's results.
The most dangerous conclusion would be to assume that this kind of episode belongs only to the world of multinationals. Malicious code with automated propagation does not check the victim's revenue before encrypting a file server, and a company with 40 or 400 employees faces the same operational shutdown with a considerably smaller cash reserve to get through ten days without systems.
Which vectors are typically behind incidents of this magnitude
Although the internal details of the incident are not public, attacks with this profile of large-scale destruction generally exploit well-known vectors, and it is worth examining the three most relevant ones in the language of whoever approves the budget. The first is the automated mass attack, in which the malicious code replicates itself across the network with no human operator picking individual targets. In practice, a single compromised device at a branch office can reach headquarters' finance server within minutes, because propagation happens at machine speed, far beyond the reaction capacity of any manual check.
The second vector is unpatched vulnerabilities. Known flaws already documented by vendors remain open for months on file servers, hypervisors, firewalls and workstations, usually because the maintenance window is never approved or because no one keeps a reliable inventory of what is installed. Verizon's Data Breach Investigations Report 2024 pointed to 180% growth in the use of vulnerability exploitation as an initial intrusion vector. Translated into everyday terms, the criminal does not need to discover anything new; it is enough to find whoever has not yet applied the published fix.
The third vector combines compromised credentials with the absence of network segmentation. When a single administrative login opens doors across every system and the network is flat, with no separation between critical servers, administrative workstations and guest devices, the compromise of one password turns into the compromise of the entire environment. The same Verizon report indicated that 68% of the breaches analyzed involved a non-malicious human element, such as someone opening an attachment, reusing a password or complying with an apparently legitimate urgent request.
Layered protection: what can be done in your environment
The first layer is endpoint protection with EDR (Endpoint Detection and Response), technology that watches behavior instead of relying solely on signatures of already cataloged threats. When a process starts encrypting files en masse or replicating to other machines, EDR automatically isolates that device from the network and contains the spread within the first few minutes, which is what separates an incident confined to one workstation from a full operational shutdown.
The second layer is backup that is isolated, encrypted and tested regularly, kept out of reach of the credentials used day to day. Sophos' State of Ransomware 2024 survey showed that 94% of organizations hit by ransomware reported attempts by criminals to compromise their backups. A mature strategy for backup and disaster recovery provides for immutable copies, credential separation and scheduled test restores, because a backup that has never been restored remains in the realm of assumptions.
The third layer adds continuous patch management to continuous proactive monitoring, with intelligent alerts that prioritize relevant signals and discard operational noise. An up-to-date asset inventory, a predictable patching cycle and centralized telemetry allow a managed cybersecurity backline to spot unusual lateral movement while it is still confined to one network segment, with continuous automated detection sustaining vigilance between human analyses.
The fourth layer brings together access control and people readiness: MFA (Multi-Factor Authentication) on all remote and administrative access, network segmentation that limits the blast radius of any compromise, ongoing user training with phishing simulations and a documented incident response plan, with defined roles, contacts, restoration order and periodic drills. Plans that are written and never tested tend to fail at exactly the moment when pressure on the team is at its peak.
Questions every decision-maker should be asking right now
Before approving any technology investment, three questions frame the conversation between the technical team and the executive board, and all of them require an answer backed by a number, a deadline, and evidence:
- Would my backups actually work in a disaster like this one? How long would it take for my operation to come back online?
- Does my team have the right tools to identify and block an attack like this immediately, before it causes full-scale damage? How am I investing in preparing my technical team?
- How long would my company survive without access to its systems and files?
Would my backups actually work in a disaster like this one? How long would it take for my operation to come back online?
The useful answer to this question is expressed through two metrics: RPO (Recovery Point Objective, how much data the company is willing to lose, measured in hours) and RTO (Recovery Time Objective, how quickly systems need to be back up). Once these values are defined together with the business units, restoration testing stops being a good intention and becomes an auditable routine, with records of the date, volume restored, and time spent in each cycle. A managed IT structure treats periodic restoration as a scheduled procedure, keeps copies isolated from the production domain, and documents the order in which systems come back, because restoring the ERP before the directory service usually means restoring everything twice.
Does my team have the right tools to identify and block an attack immediately?
Behavioral detection tools account for part of the problem, and the other part is having someone able to interpret the alert and act within minutes. EDR without continuous proactive monitoring produces logs that nobody reads, and an internal team consumed by routine tickets can hardly sustain telemetry analysis at the same time. Investment in technical readiness translates into verifiable items, such as recurring training tracks, incident response simulations with realistic scenarios, isolation and escalation playbooks, and specialized backup support that complements the internal team on the patch management and monitoring fronts. End-user training belongs in the same equation, since a large share of breaches begins with an entirely ordinary human action.
How long would my company survive without access to its systems and files?
This is the question that translates security into financial language. Multiply daily revenue by the number of days of downtime your operation could withstand, then add contractual penalties, overtime for manual recovery, lost orders, and the reputational damage with customers who will have to explain delays to their own customers. The IBM Cost of a Data Breach Report 2024 reported a global average cost of US$ 4.88 million per data breach, and business disruption accounts for a significant portion of that figure. When the number of tolerable days falls below the actual time needed to rebuild your infrastructure, there is a concrete gap to be closed with isolated backup, a tested response plan, and continuous monitoring.
If your company does not yet have an integrated layered protection strategy, consider scheduling a Strategic IT Assessment, with no obligation, to identify vulnerabilities before they become headlines.
Frequently asked questions
What is an isolated backup and why does it change the outcome of an attack?
An isolated backup is a copy of your data stored beyond the reach of the credentials and network used in daily operations, often in an immutable format that prevents modification or deletion within a defined period. This separation exists because attackers go after backups before encrypting the environment, seeking to eliminate any recovery alternative. With isolated, tested copies, the company restores its systems within a predictable timeframe instead of negotiating with criminals.
Is traditional antivirus enough against ransomware with automated propagation?
Signature-based antivirus identifies threats that have already been cataloged and struggles with new or modified code. EDR (Endpoint Detection and Response) complements that protection by analyzing behavior, detecting mass encryption or anomalous replication between machines and automatically isolating the affected device. In attacks that spread at machine speed, this automatic containment in the first few minutes makes the difference between one lost device and the entire operation going down.
How often should an incident response plan be tested?
The recommended practice is to review the plan at least twice a year and whenever there is a relevant change in infrastructure, critical systems, or the people responsible for them. Testing includes tabletop simulations with the executive board and technical restoration exercises, measuring the actual time until essential services are back. A plan that is documented but never rehearsed tends to fail at the moment of greatest pressure, when decisions have to be made in minutes.