Maersk NotPetya attack

On June 27, 2017, the NotPetya wiper — distributed via a compromised update to the Ukrainian tax-accounting software M.E.Doc and attributed by US, UK, Australian and Danish governments to the Russian GRU — propagated globally through corporate networks using EternalBlue and credential harvesting. A.P. Moller–Maersk, the world's largest container-shipping line, lost virtually its entire global IT estate within hours, including domain controllers, backups, and terminal-operating systems at 76 of its container terminals.

Maersk reported direct losses of roughly $300 million and a multi-week disruption to global container shipping; full system rebuild took ten days using a single surviving domain controller in Ghana. Total NotPetya damages across all victims exceeded $10 billion.