Maersk and NotPetya: Recovery from a Single Surviving Copy
also called NotPetya 2017
A destructive malware outbreak encrypted Maersk's estate globally, and the domain controllers were recovered only because one office had been offline during the attack.
What happened
In June 2017 the NotPetya malware — destructive rather than genuinely ransomware, since decryption was not possible — spread through networks worldwide, initially via a compromised update mechanism for Ukrainian accounting software.
Maersk, the container shipping company, had its global IT estate destroyed within a very short period. Reported losses were in the region of $250–300 million, with terminals worldwide unable to operate.
The widely-reported recovery detail is the instructive one: rebuilding Active Directory required a clean domain controller, and every domain controller in the global estate had been encrypted — except one in a Ghana office that had been disconnected during a local power cut. That single accidental offline copy was the seed for the entire recovery.
The design lessons
Online replicas are not backups. Domain controllers replicate to each other continuously, which is exactly why destructive changes propagated to all of them. Replication provides availability, not recoverability, and the distinction is invisible until an adversary is inside the replication domain.
An adversary with domain access reaches everything reachable by domain credentials, including the backup infrastructure. Backups in the same trust domain, reachable with the same credentials, are part of the blast radius.
Recovery of foundational services has an ordering problem. Identity must be restored before most other systems can be, so a plan that assumes identity is available is not a plan for this scenario.
The transferable lesson
The controls that would have made this survivable by design rather than by luck are well understood and rarely implemented fully:
Offline or immutable copies outside the production trust domain, with retention locks that credentials in the compromised environment cannot alter. Separate credentials and a separate access path for backup infrastructure. A documented and rehearsed rebuild order starting from identity. And a measured restore time at real data volume, because the recovery objective is fiction until someone has timed it.
The question to take from Maersk into any review: if every system reachable with production credentials were destroyed simultaneously tonight, what remains, and who has tested restoring from it?