- Maersk disclosed unauthorized access and data extraction from a local legacy system inherited through an acquisition.
- WhiteArmor’s claims about the data and its involvement have not been independently verified or confirmed by Maersk.
- Maersk said the incident was isolated to a local system and found no impact on other systems or connected customer and partner systems.
Maersk disclosed on Nov 11 that a threat actor gained unauthorized access to a local legacy system inherited through an earlier acquisition and extracted data from it, BleepingComputer reported.
Maersk said it found no indication of an impact on its other systems or on customer and partner systems connected through integrations such as APIs and EDI.
The system came from a previous acquisition. Maersk said its findings so far strongly suggest that no sensitive data has been disclosed, while its investigation remains ongoing.
On this page
WhiteArmor claimed the system held logistics and account data
WhiteArmor listed Maersk on its leak site on Nov 7 and threatened to publish information it claimed to have obtained unless Maersk paid a $5 million ransom, according to WhiteArmor.
The group claimed to have obtained approximately 100GB of data from a platform associated with LF Logistics, a Hong Kong-based logistics company acquired by Maersk in 2022. Its claims included roughly 29,000 driver records, 16,123 staff accounts and more than 27,000 mobile device logs.
The alleged data also included delivery recipients’ information, signed delivery receipts, inventory records, purchase orders and shipping notices. Maersk has not confirmed the types of data extracted.
Maersk said customer operations could continue
Maersk said it did not anticipate disruption to operations for customers at this time, and customers could continue to use its platforms to book and manage shipments as usual.
Infosecurity Magazine reported that Maersk had not clarified when the unauthorized access occurred.
Logistics companies have faced similar claims
Nick Harris said several WhiteArmor attacks targeted logistics companies, including J.B. Hunt, Ryder and Echo Global Logistics.
Treat possible insider recruitment as “assumed compromise” and set controls and alerts accordingly, Nick Harris said.
Maersk said its cybersecurity team launched a full investigation after discovering the issue and took action to secure the affected system. It said customers could continue using its platforms to book and manage shipments as usual.
The company has not confirmed WhiteArmor’s involvement or identified the types of data extracted. It also advised people to treat unexpected communications claiming to relate to the matter with caution and verify them through their usual Maersk contact.
FAQ
What happened to Maersk?
Maersk disclosed unauthorized access and data extraction from a local legacy system inherited through a previous acquisition. Its investigation remains ongoing.
What data did the attackers take from Maersk?
WhiteArmor claimed the data included driver records, staff accounts, mobile device logs, delivery information and logistics documents. Maersk has not confirmed the types of data extracted.
Did the Maersk incident affect customer systems?
Maersk said the incident was isolated to a local system and found no indication of an impact on other Maersk systems or customer and partner systems connected through APIs and EDI.
Can Maersk customers still book shipments?
Maersk said customers could continue to use its platforms to book and manage shipments as usual and that it did not anticipate disruption to operations at that time.
What is Maersk doing about the incident?
Maersk said its cybersecurity team launched a full investigation and took action to secure the affected system.
Sources
- IT security incident, MaerskPrimary
- Maersk Confirms Data Theft Amid $5 Million Extortion Attempt, SecurityWeek
- Maersk confirms data breach as WhiteArmor ransomware demands $5 million, BleepingComputer
- Maersk Reveals Data Breach as Extortion Group Demands $5m, Infosecurity Magazine
- Maersk confirms cyberattack after hackers access old IT system, Cybernews
- Maersk confirms data theft from legacy system, Computing
How we checked this story
| Claim | Source | Status |
|---|---|---|
| Maersk identified unauthorized access and data extraction from one of its local legacy systems from a previous acquisition. | Maersk | Confirmed |
| Maersk said its cybersecurity team discovered the issue, launched an investigation, and took swift action to secure the affected system. | Maersk | Confirmed |
| Maersk said its findings strongly suggested that no sensitive data had been disclosed. | Maersk | Confirmed |
| Maersk said the incident was isolated to a local system and found no impact on other systems or connected customer and partner systems. | Maersk | Confirmed |
| Maersk said customers could continue using its platforms to book and manage shipments without anticipated disruption. | Maersk | Confirmed |
| WhiteArmor listed Maersk on its leak site on November 7 and threatened to publish stolen information unless Maersk paid $5 million. | WhiteArmor, via SecurityWeek | Attributed |
| WhiteArmor claimed to have obtained approximately 100GB of data from a platform associated with LF Logistics, acquired by Maersk in 2022. | WhiteArmor, via SecurityWeek | Attributed |
| WhiteArmor claimed the alleged data included roughly 29,000 driver records, including 16,093 with plaintext passwords, and 16,123 staff accounts. | WhiteArmor, via SecurityWeek | Attributed |
| WhiteArmor claimed to possess delivery recipients’ information, signed delivery receipts, inventory records, purchase orders, and shipping notices. | WhiteArmor, via SecurityWeek | Attributed |
| WhiteArmor claimed to have stolen more than 27,000 mobile device logs containing phone numbers, email addresses, and IMEI identifiers. | WhiteArmor, via SecurityWeek | Attributed |
| Maersk has not confirmed WhiteArmor’s involvement or the types of data stolen, and its investigation remains ongoing. | Maersk, via SecurityWeek | Attributed |
| BleepingComputer reported that Maersk said a threat actor gained unauthorized access to a local legacy system inherited through an earlier acquisition and extracted data. | Maersk, via BleepingComputer | Attributed |
| Infosecurity Magazine reported that Maersk identified unauthorized access and data extraction but did not clarify when it occurred. | Infosecurity Magazine | Attributed |
| Nick Harris said several WhiteArmor attacks targeted logistics companies including J.B. Hunt, Ryder, and Echo Global Logistics. | Nick Harris, via Infosecurity Magazine | Attributed |
| Infosecurity Magazine reported that Maersk said it had not experienced a serious cyber incident since the 2017 NotPetya campaign. | Infosecurity Magazine | Attributed |
| Cybernews reported that hackers stole data from a legacy system Maersk inherited through a previous acquisition. | Cybernews | Attributed |
| Computing reported that Maersk confirmed a data breach connected to a system inherited through its 2022 acquisition and that an investigation was ongoing. | Computing | Attributed |
| Maersk advised people to treat unexpected communications claiming to relate to the incident with caution and verify them through their usual contact. | Maersk | Confirmed |
| maersk.com published its report on Nov 11, 2026. | maersk.com | Confirmed |
Could not verify
- Whether WhiteArmor was responsible for the intrusion is not established
- Whether the claimed data was actually stolen is not established
- How many people or organizations were affected is not established
- How the attackers gained access is not established
- Whether sensitive data was disclosed is not established
Related stories
Data LeaksArara email service breach exposed more than 1 million Osaka addresses
Data LeaksClaude Code command saved credentials to public Git repos, report says
Data LeaksRailway attack exposed customer variables and enabled unauthorized AI usage