A.P. Moller-Maersk confirmed in a statement on November 11 that attackers accessed and extracted data from a legacy system the company inherited through an acquisition. The WhiteArmor ransomware group, which listed Maersk on its leak site on November 7, is demanding $5 million in bitcoin within 30 days.
Maersk Says the Breach Was Isolated to One Legacy System
Maersk described the compromised environment as “one of our local legacy systems from a previous acquisition.” The company said unauthorized access and data extraction took place on that system. It has not named the system, the types of data involved or the date of the intrusion, and it has not confirmed that WhiteArmor was responsible.
What Maersk Told Customers and Partners
According to the company, its findings “strongly suggest no sensitive data has been disclosed.” Maersk characterized the incident as isolated and said it had no effect on other Maersk systems or on customer and partner systems connected through APIs and EDI. Shipment booking platforms remain available, and the company does not expect operational disruption.
Maersk said it secured the affected system and launched a full investigation. It promised further updates and said it would notify affected parties. The company also warned customers to verify any unexpected communications through their usual Maersk contact.
Scale of the Company Behind the Incident
Maersk operates in 130 countries, runs about 700 container ships and employs about 100,000 people. It reported $54 billion in revenue last year. The Register contrasted the current incident with the 2017 NotPetya attack, which cost the company about $300 million.
WhiteArmor’s Claims About the OCF and LF Logistics Platform
WhiteArmor, spelled WhiteArmour by Cybernews, says it stole about 100 GB from the OCF/LF Logistics platform. The group’s 30-day bitcoin deadline puts the payment window into early December. None of the group’s claims have been independently verified.
LF Logistics and the 2022 Acquisition Link
LF Logistics is a Hong Kong-based logistics company that Maersk acquired from Li & Fung in 2022. Cybernews researchers concluded that the data relates to LF Logistics and mostly contains information belonging to other logistics companies rather than to Maersk itself. That finding is consistent with Maersk’s description of a legacy system from an earlier acquisition.
The Alleged Driver and Staff Records
SecurityWeek reported the alleged haul, again unverified. It lists about 29,000 driver records that include 16,093 plaintext passwords, and 16,123 staff accounts, of which 33 are super-administrator accounts. The group also claims delivery recipient data, signed delivery receipts, inventory records, purchase orders and shipping notices.
The claimed data further includes more than 27,000 mobile device logs containing phone numbers, email addresses and IMEI identifiers. If accurate, the exposure would center on driver and staff credentials and on delivery data rather than on core Maersk shipping operations.
Conflicting Accounts Leave the Real Exposure Unclear
The gap between Maersk’s reassurance and WhiteArmor’s inventory remains open. Maersk says sensitive data was probably not disclosed, but it has not described what was taken. WhiteArmor describes a large cache of credentials and operational records, and Cybernews places the data in LF Logistics’ environment.
Reporting from The Register, Security Affairs, Infosecurity Magazine, BleepingComputer, SecurityWeek and Cybernews all rely on the same two sources: Maersk’s brief statement and the group’s leak-site listing. The company’s investigation is ongoing, and the exposure scope depends on whether the leak-site claims hold up.
The case also shows how inherited systems can carry risk into large enterprises. Maersk’s own account places the breach in a legacy platform from a prior deal, and the researchers’ reading of the data points to a subsidiary acquired four years ago.
