What Mærsk's NotPetya Recovery Can Teach Us About Cyber Resilience
When A.P. Møller - Mærsk was hit by the NotPetya cyberattack in June 2017, it became one of the most disruptive cyber incidents in modern business history.
Within hours, thousands of servers and tens of thousands of endpoints were rendered unusable. Operations across ports, terminals and offices around the world were affected, highlighting just how dependent global organisations have become on connected digital infrastructure.
Nearly a decade later, the incident remains one of the clearest examples of why cyber resilience is about more than preventing attacks. It is equally about ensuring that critical systems can be restored when prevention fails.
A Highly Connected Infrastructure
Like many global organisations, Mærsk relied on a centrally managed IT environment designed to support users and operations across hundreds of locations worldwide.
This approach delivered efficiency, consistency and global connectivity. But it also meant that systems were closely interconnected.
When NotPetya entered the organisation through compromised accounting software used by Mærsk's office in Ukraine, it did not remain a local issue for long.
The malware spread rapidly across the network, impacting thousands of systems and severely disrupting the company's digital operations.
An Unexpected Lifeline
As recovery teams worked to assess the damage, they searched for an uncompromised copy of the Active Directory database needed to rebuild the environment.
Most systems had already been affected.
One had not.
A Domain Controller located in Ghana happened to be offline due to a local power outage shortly before the attack reached the site. Because the server was disconnected from the network, it avoided the same fate as many other systems across the organisation.
That single server contained a clean copy of the data needed to begin rebuilding Mærsk's identity infrastructure. Sometimes resilience comes from careful planning. In this case, it also involved a degree of luck.
Recovery Depends on What Survives
The story of Mærsk's recovery is often remembered because of the Ghana server. But the real lesson goes far beyond a fortunate coincidence.
Modern organisations are increasingly built around connected systems, cloud services and automated processes. These capabilities create efficiency and flexibility, but they can also increase the potential impact of a cyber incident if sufficient safeguards are not in place.
The ability to recover depends on ensuring that critical data, identities and recovery mechanisms remain available, even when parts of the production environment are compromised.
