Pharma · 2017
Merck and the NotPetya cyberattack
$870M, and medicines that stopped being made.
What happened
NotPetya entered Merck through a compromised update to M.E.Doc, accounting software used by its operation in Ukraine. Court records say it damaged data on more than 40,000 computers and disrupted manufacturing, research and sales worldwide. Merck continued supplying several medicines from inventory, but production problems contributed to a Gardasil 9 shortage and the use of doses from a US government stockpile.
Merck's public filings describe hundreds of millions of dollars in lost sales, manufacturing disruption and recovery expenses, about $870M when the related disclosed effects are combined. NotPetya spread through a Windows vulnerability, stolen administrative credentials and legitimate management tools, turning one compromised supplier into a global incident. Merck later pursued a separate $1.4B insurance claim; courts rejected the insurers' war-exclusion argument, and the dispute settled in 2024.
What would have changed it
Supply-chain trust, privileged access and segmentation failed together. We reduce all three paths instead of treating one patch as the whole defense.