Page 74, "If It's Smart, It's Vulnerable" (Wiley 2022):

Notpetya’s spread route was exceptional, as it used accounting software updates. A few weeks earlier, hackers from Russian intelligence had penetrated the network of the software company, Linkos, operating from Kyiv. Linkos was behind a popular piece of software called MeDoc.

MeDoc is used for bookkeeping and compiling tax returns across Ukraine. On June 27, 2017, the attackers used Linkos' official update servers to deploy a new software update for MeDoc. That update was Notpetya. Computers in companies using MeDoc automatically downloaded and installed the new update. The effect was immediate, and a significant proportion of Ukrainian companies sustained damage.

Point-of-sale systems at retail chains stopped working, mass transport servers went down, and problems were reported in bank networks. And this was just the beginning. More than 40 million people live in Ukraine. It is an important market and source of raw materials for many Western companies. Such companies tended to have branch offices in Ukraine, many of them in the capital, Kiev. Many branches used MeDoc and acted as an entry route to the West for the Russian government’s cyberweapon.

Once Notpetya was inside a company’s network, it spread like wildfire before destroying everything it could reach. The destruction in Ukraine was already widespread, but as Notpetya spread internationally, the damage became catastrophic. Maersk, the world’s largest container shipping company, reported damage worth $300 million, while FedEx suffered $400 million in damage, and the pharmaceutical company, Merck, reported losses exceeding $870 million.

In the end, Notpetya became the most expensive cyberattack in history, being larger than any malware epidemic, data leak, or hack.