While it was the fourth day of the worst cyber-attack in company history, Tim Ferguson could not help but crack a smile at the present situation.
Recovery teams were finished preparing a critical piece of the recovery, a master image of the Microsoft Windows 10 Operating System, that would bring 50,000 employee computers back to life. But how to get it out to the company’s nearly 600 global office locations?
"Less than half of those locations have the bandwidth needed to download it from the internet. So, we needed 2,000 USB sticks and a postman, right away," says Ferguson, who on a normal day is Head of Programme & Service Transition but was taking a shift as Manager on Duty in charge of approving all decisions made by the recovery teams. "It turns out that shops carry no more than fifty USB sticks. So we sent people out in cars to buy every single one and these replicator machines so we could load them in big batches.”
The next morning Ferguson estimates they posted 300 DHL packages, with five or six USB sticks in each, to every corner of the globe. “We bought every USB in a 25-mile radius of the office. I’m sure someone out there got one shaped like Homer Simpson.”
An eerie silence
Three days before was Tuesday, 27 June 2017, a day that quickly went from normal to code-red for the more than 400 employees who work on six floors of an eight-storey building in Maidenhead, England. This is Maersk’s IT hub in the UK and Maersk Post visited in August to better understand what occurred in the last days of June.
While roughly half the people here work on maintaining the IT architecture and applications that run the global business, the other half work on developing new functionality and services. It is only now that they are beginning to be released from recovery teams back to their regular jobs.
Many Maidenhead employees were on holiday or working from home the day the malware hit. John Ashley was enjoying the view of his garden from his new home office when his screen went blank and the “notPetya” ransomware text appeared. After a phone call to his manager, he was in his car heading to the office.