Maersk confirms breach of legacy system as WhiteArmor demands $5 million

What Maersk has confirmed

A.P. Moller–Maersk has acknowledged that an unauthorised party accessed a local legacy system that came to the company through an earlier acquisition and removed information from it, according to BleepingComputer. The shipping and logistics group said its investigation is still running, but that evidence so far points to no sensitive data having been exposed.

Maersk also said it does not anticipate operational disruption and that customers can keep booking and managing shipments as normal. The company described the incident as confined to one local system, adding that it has seen nothing to suggest other Maersk systems were touched, nor customer and partner systems connected through integrations such as APIs and EDI.

The disclosure left several questions open. Maersk did not identify the affected system, say what kinds of data were involved, or specify when the intrusion happened. BleepingComputer said it asked the company for more detail and had not received a reply by publication.

The gang's claims and its price

Over the weekend, the WhiteArmor ransomware group listed Maersk on its data leak site and publicly set a demand of $5 million, payable in bitcoin within 30 days. The group says it holds about 100GB of material that it claims was taken from the company's OCF/LF Logistics platform, and it is using that alleged haul to pressure the company.

In its public message, WhiteArmor pointed to Maersk's contract-logistics business, the former LF Logistics, which handles fulfilment for large consumer brands, and argued the sum is small relative to that operation. The group also listed what it says is in its possession: close to 30,000 driver records, passwords stored without hashing, 33 accounts with the highest level of administrative privilege, signed delivery receipts, and inventory rows tied to purchase orders and Advance Shipping Notices. It further claims to hold 27,842 mobile device logs containing phone numbers, email addresses and IMEI numbers.

These are the attackers' assertions, not findings confirmed by Maersk. The company has not verified the volume, the categories of data or the specific records the group describes, and none of those claims should be treated as established fact.

Why a legacy system matters

The platform at the centre of the dispute traces back to LF Logistics, which Maersk bought from the Li & Fung Group in 2022. Systems absorbed through acquisitions are a familiar weak point, because they can sit outside the security monitoring and patching routines applied to a parent company's core estate. Maersk's own wording, that the incident is isolated to a local system, fits that pattern.

Maersk is one of the largest container carriers in the world, running ocean freight, port terminals, warehouses and air and land transport across 130 countries. Its scale means even a contained incident draws attention from customers, regulators and insurers, and the company's statement that integrations were unaffected is aimed squarely at that audience.

Maersk said it will contact customers as more relevant information emerges, and if it finds a need to inform affected parties of further findings. It also urged recipients to treat unexpected messages about the matter with suspicion and to check them through their usual Maersk contact, a sensible precaution when a breach becomes public and criminals may try to exploit it.

A history with destructive attacks

This is not Maersk's first serious security episode. In 2017 the NotPetya outbreak forced the company to rebuild more than 4,000 servers and 45,000 workstations from scratch, and it operated without IT for ten days. The damage from that event was estimated at up to $300 million.

That history explains the careful tone of the current disclosure. Maersk is signalling containment and continuity of service while an investigation continues, rather than offering a full account of what was taken. Readers with a business relationship with the company should watch for official updates from Maersk itself and verify any unsolicited communication that references the incident.