how it happened
- whoNotPetyawiper malware
- the gapflat networkbackups on the same network
- thenall domain controllersone survived offline in Ghana
- the result~$300M costrebuilt from one drive
what everyone assumed
Backups feel like insurance that is always there when needed. The assumption is that because copies exist, recovery is available, without asking whether the copies could be destroyed by the same event that destroyed the originals.
what happened
NotPetya wiped tens of thousands of machines and every domain controller almost simultaneously, because the malware spread across exactly the network the backups lived on. The company could rebuild its identity backbone only because one controller in Ghana had been offline during a power cut, surviving by accident.
step by step
- backups live on the same network as productionIncluding every domain controller.the assumption breaks here
- June 2017NotPetya wipes tens of thousands of machinesAnd all domain controllers, almost at once.
- one controller in Ghana was offline in a power cutIt survives by accident.
- the drive is couriered to LondonRecovery of the global identity system hinges on it. Cost about $300 million.
how it surfaced
In June 2017 the attack cost the company around $300 million, and the recovery of its entire global identity system hinged on a single backup that happened to be unplugged. Staff physically couriered the drive from Ghana to London.
A backup reachable by whatever destroys the original is not a backup.
Recovery depends on a copy that is isolated from the disaster, not merely replicated within it.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersMalware wipes every machine and every backup in one go.what it costs youYou recover only because one copy happened to be unplugged, by pure luck.
- or it goes like thisit happenedCDK Global, 2024howYour main software vendor is hit and goes dark for two weeks.what leavessales, orders and invoicingwho ends up with itcompetitors, as customers go elsewhere
- or it goes like thisit happenedCode Spaces, 2014howBackups live where the attacker can delete them too.what leaveseverything, with nothing left to restorewho ends up with itthe business itself, which closes
sources
your turn
what you can do about it
this week
Confirm one backup is offline or immutable, and test a restore from it.
Your backups exist, but whether one of them is isolated from a tenant-wide compromise, offline or immutable, beyond the reach of a stolen admin account, is a different question. Maersk recovered on luck. A tested, isolated copy is what stands in for a power cut in Ghana.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →