Threat watch / Breach
Maersk: unauthorised access and data extraction from a local legacy system
The Danish shipping group said on November 11 that it was investigating an IT security incident involving unauthorised access and data extraction from one of its local legacy systems, which came from a previous acquisition. Maersk says the incident is isolated to that system, that its findings so far strongly suggest no sensitive data was disclosed, and that it does not expect disruption for customers.
- Sector
- Transport
- Way in
- Not public yet
- Product or vendor
- None named
- How it happened
- Unauthorised access to "one of our local legacy systems from a previous acquisition", from which data was extracted, Maersk says. It has not said how the attackers got in, which system it was or which acquired company it came from.[3][1] Checked 11 Nov 2026
- What was stolen
- Data was extracted from the legacy system. Maersk says its findings so far "strongly suggested" that no sensitive data was disclosed; what the data was is not public.[3][1] Checked 11 Nov 2026
- Who was impacted
- Not public yet Checked 11 Nov 2026
- Threat actor
- Not attributed
Timeline
- The WhiteArmor group lists Maersk on its extortion leak site, claiming about 100 GB of logistics data and asking for $5 million, according to CyPro, which calls the claim unverified. Maersk has not linked its incident to this claim. [2]
- Maersk says it is investigating unauthorised access and data extraction from a local legacy system: "The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems". It does not expect disruption to customer operations, according to Reuters. [3][1]
- BleepingComputer reports WhiteArmor's claim in more detail: about 100 GB from what it calls the "OCF/LF Logistics platform", including about 30,000 driver records and plaintext passwords, with a $5 million bitcoin demand within 30 days. BleepingComputer links the name to LF Logistics, which Maersk bought in 2022. Maersk's statement does not mention WhiteArmor, a ransom or the platform's name. [4][3]