The aim of the article is to analyse NotPetya’s cyber-attack in terms of forensics and Polish criminal law. The discussion of forensic aspects includes the identification of techniques, tactics and procedures used by the perpetrators to launch the attack, including the malicious software used, the identification of victims and the justification for their selection by the attackers. In addition, difficulties in identifying the perpetrators have been outlined. The legal analysis included an indication of the possible legal classification of acts committed by the perpetrators under the Polish criminal code. The work concludes with an assessment of the significance of the attack, conclusions de lege ferenda, both for forensics and criminal law.