NotPetya
Destructive June 2017 malware that the UK attributed to the Russian military.
Boston Scientific's warning on 8 September 2026 that a network outage would push its results below guidance revived the NotPetya comparison: the June 2017 malware disrupted Merck's worldwide manufacturing and cut its 2017 sales by about $260m.
Last refreshed: 12 October 2026
Why is NotPetya still the benchmark for a cyber hit on manufacturing?
Timeline for NotPetya
Mentioned in: Boston Scientific likely to miss guidance
Cybersecurity: Threats and DefencesBackground
NotPetya was destructive malware released in June 2017. Its main targets, according to the UK Government, were Ukraine's financial, energy and government sectors, but an indiscriminate design carried it into companies across Europe and Russia.
Britain named the Russian military as responsible on 15 February 2018, and the NCSC judged it "almost certainly" so. Merck says a network attack on 27 June 2017 disrupted its manufacturing worldwide and cut that year's sales by about $260m. The drugmaker had to borrow doses of its Gardasil vaccine from the US Centers for Disease Control stockpile.
NotPetya remains the benchmark for state malware that escapes its intended target. For manufacturers NotPetya also set the measure of how a cyber outage turns into two years of lost sales.
