BreachCalc

Documented incident: Maersk confirmed the June 27, 2017 attack disrupted IT at multiple sites and affected APM Terminals in several ports. Its June 28 update said vessels remained maneuverable, could communicate, and crews were safe. Its 2017 annual report estimated USD 250–300 million in losses, including revenue loss, IT restoration, and extraordinary operating costs.

Technical evidence: Microsoft linked infections in the broader outbreak to the M.E.Doc updater and described credential-based spread and exploitation of unpatched SMB systems. This is outbreak-level evidence, not a verified map of Maersk’s internal network.

Fictional comparison: Terminal 07, network layout, all timestamps, throughput, response choices, and recovery are invented training assumptions. No navigation, propulsion, crane-control compromise, or cargo destruction is assumed. Early containment depends on tested segmentation and continuity arrangements.

Queue = max(0, previous queue + arrivals − completed moves) per interval. At hour 12: delayed 1,200 − 560 = 640 queued; early 1,200 − 1,180 = 20 queued. Both return to 100/h at hour 12; existing queues still require clearance. The historical USD 250–300 million estimate is not an output of this model. Playback compresses simulated hours and advances after each narration clip; muted playback uses reading time.

• Maersk · June 28, 2017 operational update
• Maersk · Annual Report 2017 (Risk management: Cyber-attack)
• Microsoft · June 27, 2017 technical investigation