FedEx braces for financial loss as global cyberattack leaves computer systems offline

FedEx Corp., the multinational courier and delivery services firm, has revealed it is yet to regain full operational control of its Netherlands-based subsidiary TNT Express, a transportation company it acquired in May 2016 for $4.8bn (£3.7bn), following a global cyberattack last month.

In an annual report for the fiscal year 2017 sent to the Securities and Exchange Commission (SEC), FedEx revealed that the June 27 'NotPetya' ransomware attack will have both financial and "material" consequences on the business, warning some systems may be lost forever.

A FedEx statement read: "We cannot estimate when TNT services will be fully restored.

"Contingency plans that make use of both FedEx Express and TNT networks remain in place to minimise the impacts to customers.

"Our information technology teams have been focused on the recovery of critical systems and continue to make progress in resuming full services and restoring critical systems. We are currently focused on restoring remaining operational [and back-end] systems.

"We cannot yet estimate how long it will take to restore the systems that were impacted, and it is reasonably possible that TNT will be unable to fully restore all of the affected systems and recover all of the critical business data that was encrypted."

The NotPetya cyberattack in late-June first hit companies across Ukraine and Russia, locking down computers and demanding $300 worth of bitcoin. It spread across the globe via hacked updates from a piece of widely-used accounting software known as MeDoc.

TNT Express operates in Ukraine and used the compromised software. This, FedEx said, allowed the ransomware to "infiltrate" its computer systems and encrypt sensitive data. The firm maintained that no customer data was breached or leaked as a result of the incident.

"A loss in revenue"

Company officials said that the sheer scope of the NotPetya cyberattack, which eventually spread to more than 60 countries, means that bosses are still evaluating the financial impact. The firm revealed that the business did not have a cyber-insurance policy in place.

"Although we cannot currently quantify the amounts, we have experienced loss of revenue due to decreased volumes at TNT and incremental costs associated with the implementation of contingency plans and the remediation of affected systems," the statement read.

The SEC filing said all TNT depots, hubs and facilities are operational, but that "customers are still experiencing widespread service and invoicing delays." It revealed that "manual processes" were now being used to keep the day-to-day business functioning as usual.

According to the Associated Press (AP), shares of FedEx fell 3.4% on Monday 17 July after the filing was published, but recovered half of this loss by the close of trading.