The Wall Street Journal reports on the malware attack that shut down the Colonial pipeline late last week:
While ransomware has been a challenge for small businesses for years, a confluence of factors have emboldened attackers in the past year, culminating in the shutdown Friday of a critical gasoline pipeline to the U.S. East Coast. The pipeline’s operator, Colonial Pipeline Co., now says service could be offline until week’s end, threatening to raise prices at the pump for millions of Americans.
How soon we forget. The NotPetya malware attack happened four years ago and shut down operations at the Maersk shipping line for more than two weeks. Adam Banks, head of technology at Maersk, describes what happened:
Two years on, Banks is willing to outline the scale of the destruction he encountered as what later become known as the NotPetya malware took hold and the company’s operations ground to a halt. “All end-user devices, including 49,000 laptops and print capability, were destroyed,” he says. “All of our 1,200 applications were inaccessible and approximately 1,000 were destroyed. Data was preserved on back-ups but the applications themselves couldn’t be restored from those as they would immediately have been re-infected. Around 3,500 of our 6,200 servers were destroyed — and again they couldn’t be reinstalled.”
The cyber-attack also hit communications. All fixed line phones were inoperable due to the network damage and, because they'd been synchronized with Outlook, all contacts had been wiped from mobiles — severely hampering any kind of coordinated response.
....Banks is candid about the breadth of the impact: “There was 100% destruction of anything based on Microsoft that was attached to the network.”
Maersk was able to recover only thanks to a wild bit of good luck: an uninfected directory file from their office in Nigeria. Even at that, though, the effect on shipping was a hundred times greater than the Suez Canal blockage earlier this year, and the damage to Maersk clocked in at about $300 million.
The NotPetya attack also hit WPP, Merck, Rosneft, Saint-Gobain, DHL, Cadbury's, JNPT, FedEx, and others. Total damage has been estimated at around $10 billion.
Technically, NotPetya wasn't a ransomware attack because the payload had been altered so that the files it encrypted couldn't be decrypted at all by anyone. But that's a tiny difference. We've known for a long time just how destructive this stuff can be on both small companies and the largest of multinational corporations. Nothing that happened this year taught us anything new.