Maersk Reinstalled 45,000 PCs in Ten Days After NotPetya — and Then Never Trued Up the Bill

On the morning of 27 June 2017, screens across the world's largest shipping company went dark in minutes. A worm called NotPetya, loosed on Ukraine and spreading with no regard for borders, tore through Maersk's network and encrypted everything it touched. By the next day the company was confirming, in the flattest possible language, that 'IT systems are down across multiple sites and select business units.'⁸ The company that moves a fifth of the world's container trade suddenly could not tell a truck driver which box to load. And then it did something remarkable: it rebuilt almost the entire estate in ten days, and later told the world what it cost.

The official story is a triumph — a heroic recovery capped by an honest, precise price tag of $200-300 million. The recovery is real and well-corroborated. The price tag is where the story quietly turns, because that number was never actually settled. It was a forecast made six weeks after the attack, then copied forward and never audited.

Ten days to rebuild what would normally take six months: the recovery half of the story is the part that holds up under scrutiny

Start with what is genuinely documented, because it is genuinely impressive. Speaking on a cybersecurity panel at Davos in January 2018, chairman Jim Hagemann Snabe described the scale of the reinstall: 4,000 new servers, 45,000 new PCs, and 2,500 applications, put back over what he called a heroic effort of about ten days — a job he said would normally take roughly six months.⁴ During that window the company kept cargo moving by hand, absorbing an estimated 20% drop in volume rather than stopping altogether.⁴ Maersk's own contemporaneous account lines up with the timeline: Maersk Line was taking bookings from existing customers two days after the attack, with operations gradually returning to normal over the following week.⁵ Compress six months of work into ten days while running a global logistics network on paper and phone calls, and you have earned the story.

One detail carries the drama, and it deserves a careful label. Journalist Andy Greenberg reported, from interviews with more than a dozen Maersk IT staff, that NotPetya wiped all of the company's roughly 150 domain controllers — the machines that hold the keys to the whole network — and that administrators eventually found the one surviving copy on a single machine in a Ghana office, offline during a power blackout when the malware struck, its data then physically relayed via Nigeria to the UK to begin the rebuild.⁶ It is the kind of story that gets repeated as confirmed corporate history. It is not. It comes from one investigative source and has never been confirmed by any Maersk filing or release. Believe it if you like — but know that you are believing a reporter's sources, not the company's books.

The $300 million that was guessed once and never checked again: a preliminary estimate hardened into a settled fact through sheer repetition

Here is the part that gets read backwards. The famous cost figure did not arrive at the end of the ordeal as an audited reckoning. It arrived at the start, as guidance. In the Q2 2017 interim report — issued 16 August, barely six weeks after the attack — Skou told investors Maersk expected a negative impact of $200-300 million.¹ That was a preliminary business-interruption estimate, the sort of range a company gives while the dust is still settling. What happened next is the tell: in the Q3 2017 report, the figure reappeared as a $250-300 million impact in Transport & Logistics, carried forward essentially unchanged.² And in the 2017 annual report's risk-management section, it appeared a third time — 'losses in the order of USD 250-300m' covering lost revenue, IT restoration and extraordinary operating costs.³ Three filings, one number, never revised. Maersk never trued that estimate up to an audited final cost in its public disclosures. It simply repeated its first guess until repetition made it look like a conclusion.

Why does the mechanism matter? Because a business-interruption estimate and a total cost of damage are two different animals wearing the same suit. The early range was built to answer investors' immediate question — how much will this dent this year's results? — and it was framed around lost revenue and restoration costs the company could see coming. It was never designed to be the last word on what a network-wide wipe costs an organization over years: the deferred capital, the customer relationships strained, the second-order operational drag. When a placeholder number gets no successor, it doesn't stay a placeholder. It becomes the record. The transparency everyone praises Maersk for was real about the recovery and oddly incomplete about the bill.

But wasn't Maersk unusually honest for even telling us?: the openness was genuine, which is exactly why the missing follow-up is worth naming

The fair objection is that Maersk deserves credit, not scrutiny. Most companies hit this hard say as little as legally possible; Maersk put its chairman on a public stage to walk through the wreckage in specifics.⁴ That is true, and the openness was a real service — it turned a private catastrophe into an industry case study. But candor about the heroics does not settle the arithmetic. The honest counter cuts deeper: in his book Sandworm, Greenberg reported that most of the Maersk staffers he spoke with privately suspected the company's accountants had lowballed the publicized figure.⁷ That is an attributed claim from anonymous insiders, not a documented fact, and it should be held at exactly that arm's length. But it points at the real gap. The problem was never that Maersk lied. It is that a company praised for transparency put a preliminary estimate into the world, repeated it three times, and let the market treat a forecast as a final accounting — and then never issued the accounting.

Maersk's ten days are the part that will keep getting told, and they should — a company that rebuilt 45,000 machines while moving cargo by hand did something almost nobody has matched.⁴ But the more instructive half of the story is the number that never grew up. A $200-300 million estimate was born as a forecast, wore three sets of clothes, and walked into history as a fact.¹³ The recovery proved Maersk could rebuild an entire network in ten days. The bill proved something quieter and harder: that the hardest thing to restore after a disaster isn't the servers — it's an honest count of what the disaster actually cost.