INCIDENT REPORT · CP-2017-002

NotPetya destructive malware attack

L4 · CRITICALCONFIRMED

Destructive malware disguised as ransomware spread from Ukraine on 27 June 2017 and disrupted multinational companies worldwide. The White House called it the most destructive and costly cyberattack in history.

Incident ID: CP-2017-002
Incident date: 27 JUN 2017
Detection date: 27 JUN 2017
Affected countries: Ukraine, Denmark, United States
Plotted location: Kyiv, Ukraine (Primary target country where the initial infection spread; not attacker origin)
Threat classification: Level 4 — CRITICAL
Classification rationale: Demonstrated worldwide consequences, including disruption of global shipping and pharmaceutical manufacturing.
Attack type: Wiper / Destructive Malware
Nature: Malicious activity
Attack vector: Malicious updates pushed through the compromised Ukrainian accounting software M.E.Doc, then self-propagation across networks
Sectors: Logistics, Transportation, Healthcare, Manufacturing, Government, Finance
Critical infrastructure: Yes
Organizations affected: A.P. Moller-Maersk, Merck & Co., FedEx (TNT Express), Ukrainian businesses and government agencies
Operational consequences: Maersk estimated a USD 200–300m hit to results. Merck's 2017 10-K reported about $260m in lost sales plus about $285m in net manufacturing and remediation costs. The US DOJ said three named victims lost nearly $1 billion.
Estimated financial impact: $1B — US Department of Justice (October 2020 indictment announcement): nearly $1 billion in losses to three victims named in the indictment. This is a partial figure; the White House said total damage ran to billions of dollars.
Attribution (as stated): Attributed by the US White House and UK government (February 2018) to the Russian military; the US DOJ charged GRU Unit 74455 officers in October 2020

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

NotPetya destructive malware attack

L4 · CRITICALCONFIRMED

Incident ID

CP-2017-002

Incident date

27 JUN 2017

Detection date

27 JUN 2017

Affected countries

Ukraine, Denmark, United States

Plotted location

Kyiv, Ukraine (Primary target country where the initial infection spread; not attacker origin)

Threat classification

Level 4 — CRITICAL

Classification rationale

Demonstrated worldwide consequences, including disruption of global shipping and pharmaceutical manufacturing.

Attack type

Wiper / Destructive Malware

Nature

Malicious activity

Attack vector

Malicious updates pushed through the compromised Ukrainian accounting software M.E.Doc, then self-propagation across networks

Sectors

Logistics, Transportation, Healthcare, Manufacturing, Government, Finance

Critical infrastructure

Yes

Organizations affected

A.P. Moller-Maersk, Merck & Co., FedEx (TNT Express), Ukrainian businesses and government agencies

Operational consequences

Maersk estimated a USD 200–300m hit to results. Merck's 2017 10-K reported about $260m in lost sales plus about $285m in net manufacturing and remediation costs. The US DOJ said three named victims lost nearly $1 billion.

Estimated financial impact

$1B — US Department of Justice (October 2020 indictment announcement): nearly $1 billion in losses to three victims named in the indictment. This is a partial figure; the White House said total damage ran to billions of dollars.

Attribution (as stated)

Attributed by the US White House and UK government (February 2018) to the Russian military; the US DOJ charged GRU Unit 74455 officers in October 2020