Merck Says Cyber Attack Will Hurt Annual Profits

Drug and vaccine maker Merck & Co. Inc. said it suffered a worldwide disruption of its operations when it was the victim of an international cyber attack in June, halting production of its drugs, which will hurt its profits for the rest of the year.

The company said it does not yet understand the full magnitude of the impact as it is in the process of restoring manufacturing operations. It disclosed the attack last month but did not disclose the manufacturing shutdown at the time, Reuters reported.

Merck said it was confident that it will be able to maintain a continuous supply of its top-selling and life-saving drugs, including cancer drug Keytruda, diabetes drug Januvia and hepatitis C drug Zepatier. But it warned of temporary delays in delivering some other products, which it did not identify.

“Full recovery from the cyber attack will take some time, but we are making steady progress,” Chief Executive Ken Frazier said on a conference call as the company reported quarterly results.

Merck is the latest in a string of corporations to disclose that operations were significantly disrupted by the NotPetya attack, which devastated businesses and government agencies in Ukraine a month ago and has gradually spread around the globe. Security sources said they expect more to come forward in the coming weeks.

Package delivery company FedEx Corp., shipping giant A.P. Moller-Maersk, Cadbury chocolate parent Mondelez International Inc. and British consumer goods maker Reckitt Benckiser have also said their operations were disrupted by the attack.

At least four other major US and European firms have also experienced massive outages due to NotPetya, but have held off on going public as they seek to restore systems, said a person familiar with those efforts. The source declined to identify the victims, saying the firms were not ready to go public.

NotPetya is a destructive virus capable of spreading quickly across computer networks, crippling computers by encrypting hard drives so that machines cannot run.

The attacks have caused massive disruptions to industrial networks that rely on computers because businesses must individually replace damaged drives, a labor-intensive process.

The impact on Merck was particularly troubling because it affected the firm’s ability to produce medicines, said Joshua Corman, director of the Cyber Statecraft Initiative at the Atlantic Council.

Merck’s quarterly profit blew past analysts’ estimates as demand surged for top-selling cancer drug Keytruda and the company reined in expenses.

Net income rose to $1.95 billion, or 71 cents per share, in the second quarter, from $1.21 billion, or 43 cents per share, a year earlier.