2017 Ukraine ransomware attacks

Sure did.

Uh, another thing that around that time, seismic, and we've talked about it a lot in a number of our retrospectives, is NotPetya, which I don't think will immediately spring to mind for a lot of people as an OT or industrial control or infrastructure attack, because we often just talk about it as, you know, ransomware.

But it had such a huge ripple effect that it ended up...

I mean, it, it had huge effects on infrastructure.

Yeah, and I'm gonna issue a correction to what I said earlier real quick.

It, it...

NotPetya's not ransomware.

We thought it was.

Russian GRU and FSB units, Sandworm, APT-28, Terla, they treated Ukrainian networks as a testing ground.

The power grid attacks, the NotPetya worm, the election infrastructure probing, all of that happened before Ukraine had anything resembling an offensive cyber capability.

And that's the baseline people miss.

When the war started in 2022, Ukraine wasn't starting from a standing army of government hackers.

Why is that?

Russia has some of the most capable cyber units in the world.

Sandworm alone has a track record that includes NotPetya, which caused billions in damage globally.

Why hasn't that translated into strategic

There was also the question of attribution.

In twenty seventeen, the NotPetya malware spread from Ukraine through corporate networks around the world.

The US and several allies attributed it to the Russian military, but many victims were ordinary companies with no meaningful role in geopolitics.

Drug maker Merck claimed about one point four billion dollars in damages under its property policies.

The second thing to watch for is the first big disputed claim.

Industry interviews can describe what insurers expect to cover, but their operational position will be established when an AI agent causes an eight figure loss and a carrier must either pay or explain why it won't.

The NotPetya dispute took years to resolve, and the first autonomous agent case could similarly define policy language well before it produces a final court ruling.

That'll be a moment that maybe defines the next ten years of cyber insurance standards, if not longer.

An act of war? For code?

Think about NotPetya in 2017.

Massive global damage.

When companies, including the food giant Mondelez, filed claims, some carriers said, no, hostile state activity, act of war, excluded.

The organization affected has been pretty transparent about what has happened during the incident and its resolution.

I think one of the best examples of this, NotPetya.

Remember that? So that hit organizations around the globe in 2017.

One of the organizations hit by this was the shipping giant Maersk.