Maersk’s 2017 Crisis: Lessons for 2026

When a global enterprise faces a catastrophic event, its ability to manage the narrative through earned media becomes the ultimate test of its crisis preparedness. Maersk, a titan in global shipping, offers a compelling case study in this domain, particularly following the devastating NotPetya cyberattack in June 2017. This event crippled their IT infrastructure worldwide, disrupting operations across 176 out of 343 container ships and costing the company an estimated $300 million. The challenge wasn’t just technical recovery. It was about controlling the story as the world watched.

The NotPetya Cyberattack and Immediate Fallout

The NotPetya ransomware, initially disguised as a ransomware attack, was in fact a wiper malware designed to destroy data, not merely encrypt it for ransom. It spread rapidly through networks, exploiting vulnerabilities in software updates, specifically Ukraine’s tax software. Maersk, with significant operations in Ukraine, became an unwitting victim. The attack brought terminals, logistics operations, and shipping schedules to a grinding halt. Within hours, news outlets globally were reporting on the disruption. The sheer scale of the incident meant that Maersk had no choice but to engage with the media directly and continuously.

Their initial response was critical. They confirmed the attack swiftly, acknowledging the operational impact without immediately detailing the full extent of the damage. This transparency, even when incomplete, helped to establish a degree of trust. In the early hours, the focus was on technical recovery, but simultaneously, their communications team began crafting messages. This wasn’t a time for silence. It was a moment for controlled, consistent updates. According to a Nielsen report on crisis communication, brands that issue an initial public statement within 24 hours of a crisis experience a 10% lower negative sentiment score compared to those that delay.

The challenge was compounded by the fact that Maersk’s global footprint meant different time zones and diverse media field. Coordinating responses across continents, ensuring that spokespeople were aligned, and providing accurate, evolving information to journalists demanding answers was a monumental task. This demanded an agile approach, moving beyond pre-scripted statements to dynamic engagement. The shipping industry, by its nature, relies on precision and predictability. NotPetya introduced chaos, and Maersk had to communicate their way through it.

Crafting a Coherent Narrative Through Earned Media

Maersk understood that earned media, unlike paid advertising, carries an inherent credibility. When a respected news organization reports on a company’s response to a crisis, it lends significant weight to that narrative. Their strategy focused on several key pillars: transparency, empathy, and a clear path to resolution. They didn’t downplay the severity of the attack, nor did they assign blame prematurely. Instead, they focused on their efforts to restore systems and minimize disruption for customers.

One tactical decision involved using their executive leadership. Søren Skou, then CEO of A.P. Møller-Mærsk, became a visible and reassuring presence. His interviews and statements were consistent, focusing on the company’s commitment to its customers and its employees. This direct engagement from the top helped humanize the crisis. It wasn’t just a faceless corporation grappling with a technical issue. It was a leadership team actively working to resolve a complex problem. This personal touch is often overlooked in crisis planning, but it deeply impacts public perception. A HubSpot study on executive visibility found that companies with highly visible CEOs during a crisis saw a 7% faster recovery in brand perception.

They also provided regular, detailed updates through their corporate website and social media channels, which then served as primary sources for journalists. This proactive dissemination of information reduced the need for media speculation and allowed Maersk to control the initial framing of the story. They created a dedicated crisis communication hub on their site, offering FAQs and status reports, effectively becoming their own newsroom during the emergency. This centralized approach ensured consistency and accuracy, preventing conflicting reports from emerging.

Using Industry Trust and Relationships

Maersk’s long-standing reputation in the shipping industry played a significant role in their earned media success. They had cultivated relationships with key trade publications and business journalists over decades. These existing relationships meant that when the crisis hit, there was a foundation of trust. Journalists were more inclined to seek official statements and verify facts with Maersk directly, rather than relying solely on external speculation. This is a critical, often underestimated, aspect of crisis preparedness: building goodwill before the storm hits.

The company also engaged with industry bodies and partners, demonstrating a collaborative approach to addressing a shared threat. This wasn’t just a Maersk problem. It was a problem for global logistics. By positioning themselves as part of a larger solution, they garnered support and understanding from stakeholders across the supply chain. This collaborative narrative helped to shift the perception from a single company’s failure to a broader industry challenge, which Maersk was actively working to overcome.

Beyond traditional media, Maersk also monitored and engaged with online conversations. They understood that the narrative wasn’t just being shaped by news articles. It was also being influenced by discussions on professional forums, social media, and customer service channels. Their digital teams were tasked with identifying misinformation and providing factual corrections, ensuring that the official story remained dominant. This active online engagement is non-negotiable in the current media field, where narratives can spiral out of control within minutes. I’ve seen firsthand how a single misinformed tweet can derail a carefully constructed crisis message if left unaddressed.

The Long-Term Impact and Lessons Learned

The NotPetya incident, while incredibly damaging, in the end became proof of Maersk’s resilience and their effective crisis management. Within weeks, they had restored most critical systems, rebuilt thousands of servers, and resumed operations, albeit with some lingering disruptions. The earned media coverage largely reflected this narrative of recovery and determination. Instead of being portrayed as a victim of a catastrophic failure, Maersk was often framed as a company that faced an unprecedented challenge and fought its way back. This is the power of a well-executed earned media strategy: it can transform a crisis into a narrative of strength and capability.

One of the most significant lessons is the absolute necessity of a strong internal communication strategy during a crisis. Employees are often the first line of defense and can be powerful advocates or unwitting sources of misinformation. Maersk ensured its employees were kept informed, understood the company’s messaging, and knew how to respond to external inquiries. This internal alignment is paramount for external consistency. Without it, even the best external strategy can falter.

On top of that, the incident underscored the need for continuous investment in cybersecurity and crisis preparedness. Maersk’s experience became a cautionary tale for the entire logistics sector, prompting many companies to re-evaluate their own defenses and response plans. This unsolicited industry-wide impact, driven by news coverage, further solidified Maersk’s position as a leader, not just in shipping, but also in working through complex digital threats. The company’s transparency during the crisis contributed to this broader educational impact. According to Statista data, global spending on cybersecurity solutions increased by 18% in the two years following the NotPetya attack, partly driven by such high-profile incidents.

Future-Proofing Crisis Communication

Looking ahead to 2026, the field for crisis communication and earned media is even more complex. The proliferation of AI-generated content, deepfakes, and hyper-personalized news feeds means that trust in traditional media sources is under constant pressure. For companies like Maersk, this means their crisis plans must evolve to include sophisticated monitoring tools, rapid verification processes, and multi-platform engagement strategies. The speed at which misinformation can spread demands an immediate and authoritative response.

The ability to anticipate potential narratives is also becoming more critical. What are the vulnerabilities that could become headline news? What are the public perceptions that could be exploited during a crisis? Proactive scenario planning, including mock crisis exercises with real-time media engagement simulations, is no longer optional. This preparation allows communication teams to stress-test their messaging, identify gaps in their strategy, and build the muscle memory needed for swift action. The goal isn’t to prevent all negative coverage, which is often impossible, but to ensure that the company’s perspective is heard clearly and credibly amidst the noise.

In the end, Maersk’s NotPetya ordeal highlighted that earned media in a crisis is not about spin or deflection. It’s about authentic engagement, rapid response, and a steadfast commitment to providing accurate information, even when that information is difficult to share. Their experience is a powerful reminder that an investment in transparent communication and strong media relationships pays dividends when a company’s reputation hangs in the balance.

Effective crisis management through earned media requires proactive planning, transparent communication, and consistent messaging across all channels to safeguard reputation and maintain stakeholder trust.