🔍 Read the full analysis: Maersk Says Legacy System Data Was Stolen By Ransomware Gang on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Maersk confirmed unauthorised access and data extraction from a local legacy system connected to a previous acquisition. The company says its investigation so far indicates no sensitive data has been disclosed and no impact on other systems or customer operations; a ransomware gang’s claims about the volume of data and ransom demand have not been confirmed by Maersk.
A.P. Moller–Maersk says attackers gained unauthorised access to and extracted data from a local legacy system linked to a previous acquisition, prompting an investigation that remains ongoing. Maersk says it has found no indication of effects on other company systems or customer and partner connections, and does not anticipate disruption to operations; a ransomware gang’s claims about the incident have not been confirmed by the company.
In an advisory titled “IT security incident” published November 11, Maersk said its cybersecurity team discovered the issue, launched a full investigation and took steps to secure the affected system. The company described the system as local and legacy but did not identify it or name the acquisition it came from. It also did not state when the intrusion occurred or specify what information was taken.
Maersk said its findings so far “strongly suggest no sensitive data has been disclosed.” The company did not define “sensitive” or explain in the advisory what it meant by “disclosed.” Its statement does confirm data extraction, while its assessment about sensitive data is limited to findings available so far; the investigation is not described as complete.
Separately, BleepingComputer reported that a ransomware group calling itself WhiteArmor listed Maersk on its leak site and claimed to possess about 100 GB of data. The publication reported that the group demanded US$5 million and gave Maersk 30 days to pay in bitcoin. Those details are the group’s claims as reported by BleepingComputer, not facts Maersk confirmed in its advisory. Maersk did not mention WhiteArmor or a ransom demand.
Maersk confirms data theft from a legacy system
Maersk confirmed unauthorised access and data extraction from a local system linked to a previous acquisition. Its investigation is ongoing, and the ransomware gang’s claims remain unconfirmed by Maersk.
What Maersk confirmed
The company says its findings so far indicate no sensitive data has been disclosed.
Maersk’s cybersecurity team found unauthorised access to a local legacy system.
The company confirmed data was taken and secured the affected system.
The system, data involved and timing have not been identified.
Business impact
Maersk says customers can continue booking and managing shipments as usual.
- No anticipated operational disruption
- No indication other systems are affected
- No indicated impact to customer or partner APIs and EDI
- Which records were extracted
- Whether customer data was included
- Which acquisition or system was involved
Claims not confirmed by Maersk
BleepingComputer attributed these claims to the ransomware group WhiteArmor.
| Reported claim | Maersk confirmation |
|---|---|
| About 100 GB of data | ✗ No |
| US$5 million ransom demand | ✗ No |
| Connection to LF Logistics | ✗ No |
What customers should do
The advisory does not ask customers to stop using Maersk platforms or integrations.
- Continue bookings and shipment management as usual.
- Verify unexpected incident-related messages through your usual Maersk contact.
- Watch for verified updates as the investigation progresses.
What Shippers Should Do Now
For companies moving cargo with Maersk, the immediate operational message is that bookings and shipment management can continue as usual. Maersk said it does not anticipate disruption at this time and has found no indication that other Maersk systems or customer and partner systems connected through integrations are affected. It specifically referred to connections such as APIs and EDI.
The incident still matters to customers and partners because Maersk has confirmed that data left a system, while the company has not yet identified the information involved or who may have accessed it. That leaves businesses unable to determine from the advisory whether any of their records were included. The reported ransom demand and data-volume claim add a separate reason to watch for further verified updates, but should not be treated as proof that the group’s account is accurate.
Maersk’s direct customer guidance is to treat unexpected communications about the incident with caution and verify them through a usual Maersk contact. That advice applies whether or not a message claims to offer details about the breach: the company has not said in its advisory that customers need to stop using its platforms or integrations.
Popular right now
Shark WANDVAC Power PET Cordless Handheld Vacuum, White, WV410WH
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds with Immersive Audio and Wireless Charging Case, Black
De'Longhi Classic Signature Espresso Machine with Adjustable Milk Frother
As an affiliate, we earn on qualifying purchases.
A Previous Acquisition Is Unnamed
Maersk’s description points to a system associated with “a previous acquisition,” but it does not identify the acquired business. BleepingComputer’s report provides a possible connection, saying WhiteArmor referred to an “OCF/LF Logistics platform.” This remains an attacker attribution reported by the publication, not a link made by Maersk.
Maersk completed its acquisition of LF Logistics in 2022. In its announcement at the time, the company described LF Logistics as a Hong Kong-based contract logistics business focused on areas including omnichannel fulfilment, e-commerce and inland transport in the Asia-Pacific region. Maersk said the deal added 223 warehouses, bringing its total number of facilities to 549, and that LF Logistics employed 10,000 people.
That history explains why LF Logistics may be relevant to the reported claim, but it does not establish that its systems were involved. Maersk has not named the acquisition or platform linked to the incident. A large acquisition can bring additional technology and data into a company, but the available information does not establish how the affected system was managed or why it was vulnerable.
““unauthorised access and data extraction from one of our local legacy systems from a previous acquisition.””
— A.P. Moller–Maersk, in its November 11 advisory
System, Data and Intrusion Remain Unknown
Maersk has not disclosed which system or acquisition was involved, when the unauthorised access occurred, what kinds of data were extracted, or whether any information was published or otherwise accessed beyond the attackers. The advisory also does not explain how the company is defining “sensitive data” or “disclosed.”
The reported connection to LF Logistics, the claim of about 100 GB of data and the ransom demand come from BleepingComputer’s account of WhiteArmor’s statements. Maersk has not confirmed those claims in the material available. BleepingComputer reported that it had asked Maersk for further details and had not received a response by publication. Maersk’s investigation remains ongoing, so the scope and any potential effects could become clearer later.
Maersk Investigation and Customer Updates
Maersk said it will update customers as relevant information becomes available and inform impacted parties if it finds that is needed. The company has not announced a date for its next update or said when its investigation is expected to conclude.
For now, Maersk’s stated position is that customers may continue booking and managing shipments as usual, with no anticipated operational disruption. Customers should follow the company’s instruction to verify unexpected incident-related messages through their usual Maersk contact. Any further account of the data involved or the reported ransomware demand will need to be assessed against information Maersk or other reliable sources confirm.
Key Questions
What did Maersk confirm?
Maersk confirmed unauthorised access and data extraction from a local legacy system associated with a previous acquisition. Its investigation is ongoing.
Did Maersk confirm the WhiteArmor ransom demand?
No. BleepingComputer attributed the reported 100 GB data claim and US$5 million demand to WhiteArmor. Maersk’s advisory did not name the group or confirm its claims.
Are Maersk shipments or customer connections affected?
Maersk said it had found no indication of an impact on other company systems or customer and partner connections such as APIs and EDI. It said it did not anticipate operational disruption and customers could continue using its platforms as usual.
Was LF Logistics the affected acquisition?
That has not been confirmed. BleepingComputer reported that WhiteArmor referred to an “OCF/LF Logistics platform,” but Maersk has not named the acquisition or linked the incident to LF Logistics.
What should Maersk customers do?
Maersk advises customers to treat unexpected communications about the incident cautiously and verify them through their usual Maersk contact. The company has not advised customers to stop using its platforms.
Source: ThorstenMeyerAI.com
