CIO Brief: NotPetya and the True Cost of Flat Networks and Shared Admin Accounts

Retrospective: this article looks back at events from June 2017, written in 2026 with the benefit of hindsight.

The short version: NotPetya, in 2017, entered companies through a trusted software update and then spread using administrator passwords stolen from one computer to reach all the others. Some global companies had to rebuild their entire IT environment.

Why this matters to you

Two common shortcuts turned NotPetya from an infection into a catastrophe: a "flat" network where every computer could reach every other, and administrator accounts that were shared or used everywhere. Both still exist in many mid-sized companies today because they are convenient.

The business impact

• Total outage: affected companies lost email, ordering, shipping and finance systems at once.
• Rebuild cost: recovery meant reinstalling thousands of systems.
• Insurance disputes: some insurers argued NotPetya was an act of war and excluded it, leading to years of litigation.

Questions to ask your team

• If one laptop were infected, how many systems could it reach?
• Do our administrators use separate accounts for admin work, and are those accounts used only on secured machines?
• Does every computer have a unique local administrator password?
• Are our backups isolated so malware cannot delete them?

What good looks like

Separated networks, separated admin accounts, unique local passwords, monitored admin activity, and backups that an attacker with full network access still cannot destroy.

The decision

Ask for a "blast radius" assessment: if one machine is compromised today, what else falls? The answer drives your next security investments better than any vendor pitch.