Maersk reinstalled thousands of servers and workstations to fix NotPeyta

I guess there are some factors that helps in this particular case. These are large container ships, the schedule is known very long in advance (the trips themselves take a long time too). After the initial hit the ships would have plenty of time to prepare before hitting port. Not trying to diminish the effort though! It is hard to imagine how they managed to hold everything together.

As mentioned in the embedded clip, it has the potential to get much worse in the future where even the boats are completely autonomous.

Also mentioned was that 90% of the orders came from internet, so 10% is not? Surprised me a little. Got the feeling that they have lots of manual paperwork even for internet orders, which probably helped a lot.

They still had a loss on $200-300 million, after everything. When it happend there was stories about how workers switched to using WhatsApp on their own phone to communicate.

Some of it must have been sympathy by the customers too - "We got hacked and and to re-install thousands of machines" as a customer I'd let some late shipping slide. But could the company operate at a permanent performance penalty - i.e. without IT systems. They probably couldn't stay competitive

From what I understand shipping is still an industry that operates between a few connected people. You still can barely go online and book a set of containers onto a ship, you call someone you have a relationship with. I assume that’s a big part of it.

They just started loading containers onto ships based on the best available information. Information ports had, customers, etc. A lot of containers ended up in the wrong place or simply went missing. It became a mess that will take them at least a year to fully cleanup.

They had years of organization using IT that built up a lot of inertia. As another commenter said, 10 days is probably well below the threshold of their typical shipment turnover.

My guess is they'd quickly suffer potentially company-ending losses if they were to stop using modern IT altogether.

It was much worse than Maersk's PR indicated. Their big automated ports, LA, NY, and Rotterdam, were down for most of a week. Maersk operates in about 160 ports, and about 17 were affected by the computer attack.

The Port Authority of New York and New Jersey has a message page for announcements to truckers. They're very real-world: "Gate 6 is closed due to flooding from a broken water main" kind of info. They were saying Maersk was totally down, then only handling inbound refrigerated containers, then inbound only. Later announcements mentioned manual processing, few gates open, long wait times, and suggested delaying shipments. It was about two weeks before they were fully back up and accepting everything, including empties.

LA was down for four days, but Maersk also has a terminal at Long Beach which was unaffected, so they diverted one container ship there. They weren't accepting online orders for a week or two, the tracking system was down, email was down, and they were trying to operate by voice phone only. Many customers had containers stuck in the container stacks at the port.

Rotterdam's robotic container handling was down for a while, but details are scanty. Most of the problems were apparently with the truck-side systems, the ones which get the right container onto the right truck.

This was a big deal.

> For me, the most surprising thing is that Maersk was able to carry on

It takes a while for one vessel to reach the next port/terminal. Once it left the previous terminal you'll get a stowage layout. Basically showing all the containers on a vessel and where they're supposed to unload/discharge.

You can use that file to tell the next terminal to unload whatever the file mentions. Then load whatever customers handed into the terminal and have the terminal handle the new stowage layout.

Thanks to loads of practical problems terminals are pretty capable to handle loads of things for you.

Obviously if the terminal itself is also affected it's a way bigger problem.

As someone in IT, they probably didn't get anything, maybe a friendly smile and a handshake.

I am pretty sure That Mærsk also invested a lot of money to prepere better for this in the future.

Since I am getting sick of this joke: no we don't! :P

Disaster recovery/business continuity is like insurance: you grumble about paying it (or don’t pay it at all) and then you’re happy you did pay for it when disaster strikes.

But in this case they had not patched their windows machines for a vulnerability that Microsoft fixed months before. It was really a case of dumb, careless IT.

No, Linux is not immune: https://arstechnica.com/information-technology/2017/06/web-h...