Maersk’s 2017 NotPetya Crisis: Lessons for 2026

Geopolitical tensions and cyberattacks are a constant headache for the global shipping industry. The 2017 NotPetya cyberattack against Maersk is a perfect case study in crisis communication because it wasn’t a small disruption, it was a full-blown catastrophe. The malware crippled their IT systems worldwide, forcing a complete rebuild of their digital infrastructure while they were still trying to communicate with a massive network of clients and stakeholders. This breakdown of Maersk’s response shows what leadership resilience actually looks like when disaster hits.

The NotPetya Attack: A Digital Tsunami

On June 27, 2017, the NotPetya malware started spreading. It looked like ransomware, but it was pure destruction. Maersk, with its IT systems interconnected across 130 countries, was one of the biggest victims, even though they weren’t the specific target. This was far more than a data breach. It was a complete operational shutdown. Terminals around the world stopped working, shipping schedules descended into chaos, and the basic ability to track containers simply disappeared. The first few hours were a scramble for any kind of information and control, a brutal test of their crisis plans.

Initial Response and Internal Communication Strategy

The first hours were everything. With Maersk’s IT, email, and internal chat platforms completely dead, they had to pivot fast. Senior leadership started running the global response using personal phones and encrypted apps like WhatsApp. That informal approach was exactly what was needed, as it allowed key personnel to coordinate decisions across the globe when all official channels were offline. Think about it: running a global shipping company without email. Standard protocols were useless.

The internal messaging had two goals: issue urgent operational orders and keep people from panicking. Teams were told to go back to manual processes wherever they could, a painful reminder that analog backups can be a real lifeline. Leadership’s message was clear: they acknowledged the seriousness of the attack but focused everyone on the work of restoring services, which created a sense of shared purpose.

External Communication: Transparency as a Foundation

Their external communication strategy was defined by transparency, even when they didn’t have all the answers. Just hours after the attack hit, Maersk used social media and its corporate website to put out a statement acknowledging the massive disruption. Admitting the full impact immediately set a tone of honesty. They pushed out updates constantly, sometimes several times a day, detailing what they were doing to fix the systems and giving their best guesses on timelines. This approach built significant trust because it kept everyone in the loop.

They smartly used their website as the single source of truth, pushing the same consistent messages to their social channels like LinkedIn and Facebook. They stuck to verifiable facts and the actions they were taking, avoiding any speculation. By being the one source for information, Maersk stopped the rumor mill before it could start and gave stakeholders a realistic picture of what was happening. It’s no surprise that a 2023 Statista report found 68% of consumers say clear communication during a crisis makes them trust a company more.

The Road to Recovery: Metrics and Impact

NotPetya’s impact was staggering. The company pegged the financial cost at $250 million to $300 million, a figure disclosed in their Q2 2017 earnings report that covered business interruption and the massive IT rebuild. The recovery was a near-total reconstruction. Maersk had to reinstall 4,000 servers, 45,000 PCs, and 2,500 applications across its 600 sites. That entire undertaking was finished in just a few weeks, which speaks for itself about the global IT teams’ abilities when given the power to act.

Campaign Teardown: Maersk’s Crisis Communication “Campaign”

Maersk’s crisis communication during NotPetya functioned as an intensive, real-time public relations and stakeholder management effort. You can break it down like a campaign:

• Budget: No dedicated marketing budget, but huge resources were diverted. The ~$300 million IT recovery cost was an indirect part of the comms effort, showing the company’s commitment. Communication teams worked around the clock, and they almost certainly brought in external PR help.
• Duration: The most intense phase was about 3 weeks, from late June to mid-July 2017. The recovery and follow-up communications continued for months after.
• Key Performance Indicators (KPIs):
  • Customer Retention: Minimizing customer churn was a primary goal. The company managed to retain most of its customers, who seemed to value the transparency over the disruption.
  • Reputation Management: Media coverage generally praised Maersk’s transparency, which went a long way toward protecting its public image.
  • Employee Morale: Internal communications were designed to maintain morale among employees who were under immense pressure to get the systems back online.
  • Operational Recovery Speed: This was a direct measure of success. The faster systems came back, the more credibility the communications had.
• Strategy:
  1. Rapid Acknowledgment: Get a public statement out immediately.
  2. Centralized Information Hub: Use the corporate website as the single source of truth.
  3. Multi-Channel Distribution: Push updates through social media, press releases, and direct customer outreach.
  4. Consistent Messaging: Stick to facts, actions, and estimated timelines. No sugarcoating.
  5. Leadership Visibility: Have senior executives front and center, providing updates.
• Creative Approach: The language was direct and factual, with no jargon. They even used simple graphics on social media to explain the situation. The “creative” wasn’t about flashy design. It was about the absolute clarity and consistency of the message.
• Targeting: They had to talk to everyone: B2B customers, employees, investors, media, and regulators. The messaging was tweaked for each group. For instance, customer updates focused on container status and new schedules, while investor comms hit on the financial impact.

What Worked Well:

• Transparency: Maersk’s willingness to openly talk about how bad the attack was and the tough road to recovery was the key factor in maintaining trust.
• Agility in Internal Communication: The quick move to personal devices for internal coordination kept the company from being totally paralyzed.
• Leadership Visibility and Decisiveness: Senior management was actively involved in the communication, which gave employees and customers confidence that the problem was being handled at the highest level.
• Focus on Solutions: While they owned the problem, the communication always pointed to the steps being taken to fix it. This focus on solutions was reassuring to customers worried about their cargo.

What Didn’t Work (or areas for future improvement):

• Initial Information Gap: For the first few hours, the IT outage was so complete that even Maersk didn’t know the full extent of the damage. The initial chaos showed the need for stronger incident response playbooks that can account for total systemic failure.
• Reliance on Manual Backups: Having to fall back on so many manual processes showed where their digital resilience was weak. It was a learning curve for the whole industry.

Optimization Steps Taken Post-Crisis:

Maersk didn’t just rebuild, they re-armed. They invested a fortune in new infrastructure and adopted a “shield up” mentality, which included advanced threat detection, better network segmentation, and more cyber hygiene training for employees. They also created a dedicated cyber crisis team and started running regular simulations to test their defenses. This shift from just recovering to proactively defending is a masterclass in leadership resilience. Emerging stronger and better prepared is the real goal.

The company also formalized the crisis comms protocols they’d improvised, making sure the lessons from NotPetya were baked into their official plans. This meant setting up redundant communication channels and clear paths for getting information out during an emergency. So many companies go through a crisis, learn a ton, and then fail to institutionalize any of it. Maersk understood the long-term value of codifying their newfound expertise.

Lessons in Leadership Resilience

Maersk’s NotPetya response offers some hard-won insights for leaders in any industry. First, you have to build organizational agility and adaptable communication frameworks before a disaster hits, because you’ll never predict what’s coming. Second, transparency builds trust, while secrecy in an age of instant information just erodes it. Third, support the teams on the ground. Maersk’s rebuild succeeded because it empowered its IT and operations staff to execute under extreme pressure. The cost of prevention and solid recovery plans is nothing compared to the financial and reputational hit from a badly handled crisis.

The Maersk case proves that effective crisis communication isn’t just about sending messages. It’s a core part of operational recovery and the very foundation of leadership resilience. By being transparent, adapting on the fly, and supporting their global teams, Maersk turned one of the worst corporate cyberattacks in history into a story of recovery. Leaders should be asking themselves right now if their own organizations could withstand a similar test. Are the systems and culture in place to handle the next big disruption?