Danish shipping and logistics group A.P. Moller-Maersk confirmed on November 11 that a threat actor gained unauthorized access to a legacy IT system inherited from an earlier corporate acquisition and extracted data from it, the company said in a security advisory. The disclosure followed claims by a ransomware gang calling itself WhiteArmor, which listed Maersk on its dark-web leak site and threatened to publish the stolen material unless paid.
WhiteArmor added Maersk to its extortion site over the weekend of November 7-8, demanding $5 million in bitcoin within 30 days and claiming to have stolen roughly 100 gigabytes of data from the company’s OCF and LF Logistics platform. Maersk said its investigation so far indicates the incident is confined to the single legacy system, with no evidence of impact on its broader corporate network or on customer and partner systems linked through APIs and EDI integrations.
Breach Traced to Acquired Logistics Platform
The compromised system belonged to a contract-logistics business Maersk had previously acquired, rather than to the group’s core container-shipping or terminal operations. Maersk has not disclosed when the intrusion began or detailed the exact nature of the compromised records, only confirming that a third party gained unauthorized access and extracted data from the platform.
Maersk said preliminary findings strongly suggest that no sensitive data has been disclosed publicly, and the company reported no indication that other Maersk systems, or those of customers and partners connected via integrations such as APIs and electronic data interchange, have been affected. The company is continuing to investigate the scope of the intrusion and the validity of the attackers’ data claims.
WhiteArmor Ransomware Gang Makes Its Demands
The WhiteArmor ransomware gang listed Maersk on its leak site and publicly demanded $5 million in bitcoin, giving the company 30 days to respond. The group claimed to be in possession of roughly 100GB of data extracted from Maersk’s OCF and LF Logistics platform and used the figure to pressure the company, comparing the ransom demand to a fraction of a few hours of its earnings.
WhiteArmor also claimed to have obtained more than 16,000 passwords belonging to Maersk drivers, allegedly stored in plain text. Maersk disputed that characterization, telling reporters that passwords for the system are kept in protected form and that the items actually taken were single-use authentication codes that have since expired, undercutting part of the gang’s extortion narrative.
A Narrower Incident Than the 2017 NotPetya Crisis
The disclosure inevitably invites comparison with Maersk’s 2017 NotPetya ransomware attack, which paralyzed the company’s global IT systems and container operations for days and cost hundreds of millions of dollars to remediate. Unlike that episode, the current incident is described as an unauthorized access and data-extraction event confined to one inherited legacy platform, with Maersk saying it does not anticipate disruption to customer-facing operations.
Security researchers have pointed to the breach as a reminder that systems absorbed through mergers and acquisitions often remain only loosely integrated into a parent company’s security architecture, creating entry points attackers can exploit long after a deal closes. Maersk has not said whether it intends to pay the ransom, and the WhiteArmor group’s 30-day deadline for payment had not expired as of the latest reporting.
Why it matters
The incident underscores the growing exposure of global logistics networks to ransomware extortion, even when attackers target a narrow, isolated system rather than core operational technology. Maersk handles a significant share of world container trade, and any erosion of confidence in its data security could ripple through shippers, freight forwarders and port partners that rely on its digital integrations. The case also revives memories of the 2017 NotPetya attack, which demonstrated how deeply a single cyber incident can disrupt maritime supply chains, keeping cybersecurity high on the agenda for shipping lines managing complex, acquisition-driven IT estates.
Source: BleepingComputer
