TL;DR
Maersk said on November 11 that someone accessed and extracted data from a local legacy system inherited through a previous acquisition. BleepingComputer reported that ransomware group WhiteArmor claimed responsibility, said it had about 100 GB of data and demanded $5 million; Maersk has not confirmed those claims.
A.P. Moller–Maersk said on November 11 that an intruder accessed and extracted data from a local legacy system inherited through a previous acquisition, while BleepingComputer reported that the ransomware group WhiteArmor claims to have stolen about 100 GB and is demanding $5 million. Maersk has not confirmed the gang’s identity, the amount allegedly taken or the ransom demand, and says its investigation is still underway.
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
In an advisory titled “IT security incident,” Maersk said its cybersecurity team discovered the issue, launched an investigation and took steps to secure the affected system. The company described the system as local and legacy, but did not identify it or the acquisition it came from. It also did not state when the intrusion occurred or specify what information was extracted.
Maersk said its findings so far “strongly suggest no sensitive data has been disclosed.” It reported no indication that other Maersk systems or customer and partner systems connected through integrations such as APIs and EDI were affected. The company said it does not anticipate operational disruption and that customers can continue booking and managing shipments through its platforms.
The separate account of a ransom demand comes from BleepingComputer’s November 11 report, which said WhiteArmor had listed Maersk on its leak site. According to that report, the group claimed to hold about 100 GB of data, demanded $5 million and set a 30-day deadline for payment in bitcoin. These are the gang’s claims as reported by BleepingComputer; Maersk’s advisory does not mention WhiteArmor, a ransom or a payment deadline.
What Maersk Customers Should Know
For companies moving goods through Maersk, the immediate operational message is that bookings and shipment management remain available. Maersk says it has found no sign of an impact on customer and partner integrations, including APIs and EDI, and does not expect disruption at this time. Those statements describe the company’s current findings, which could change as the investigation progresses.
The data question remains separate from the service question. Maersk confirms extraction occurred, but its wording about sensitive data is preliminary and does not identify what was taken or explain what it considers sensitive. If the gang’s claim is accurate, customers and other affected parties may need to assess whether information about their businesses or shipments was involved. No such exposure has been established in the material available so far.
Maersk advised customers to treat unexpected communications claiming to relate to the incident with caution and verify them through their usual Maersk contact. That is relevant while details are emerging: a claim about the incident, by itself, does not establish that a message is genuine or that a particular customer was affected.
Products Worth Considering
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
Apple MacBook Air 15-inch (2026) with M5 Chip, 16GB Memory, 1TB SSD, and Liquid Retina Display – Sky Blue
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
As an affiliate, we earn on qualifying purchases.
The Acquisition Behind the System
Maersk said the affected system came from “a previous acquisition,” without naming the deal. WhiteArmor’s reported reference to an “OCF/LF Logistics platform” is the basis for linking the incident to LF Logistics, but that connection has not been confirmed by Maersk.
Maersk completed its acquisition of LF Logistics on August 31, 2022. At the time, the company described LF Logistics as a Hong Kong-based contract logistics business focused on areas including e-commerce fulfilment and inland transport in Asia-Pacific. Maersk said the deal added 223 warehouses, bringing its total facilities to 549, and that LF Logistics employed 10,000 people.
The scale of that acquisition provides context for the possibility of inherited systems, but it does not establish which system was involved in this incident. The company’s advisory refers only to a local legacy system from a previous acquisition, and the connection to LF Logistics rests on the attackers’ reported claim.
““Our findings so far strongly suggest no sensitive data has been disclosed.””
— A.P. Moller–Maersk, in its November 11 security advisory
What the Investigation Has Not Established
Maersk has not named the affected system, the acquisition it came from, the date of the intrusion or the categories of data extracted. It has also not confirmed whether the data was published, viewed by anyone beyond the intruder or disclosed in another way. Its statement that findings so far suggest no sensitive data has been disclosed is preliminary, and the company does not explain the term’s scope.
WhiteArmor’s account remains unverified by Maersk. The company has not confirmed the group’s responsibility, its claimed 100 GB volume, the reported $5 million demand, the payment deadline or the connection to LF Logistics. BleepingComputer reported that it had sought further details from Maersk but had not received a response by publication. Whether any customers or partners are directly affected is also not yet known.
Further Findings and Customer Notices
Maersk said it will update customers when more relevant information becomes available and will inform impacted parties if it determines that notification is needed. The investigation is ongoing, so the company’s account of the incident and its assessment of potential impact may be updated.
For now, Maersk says customers can continue to use its platforms to book and manage shipments. It asks them to verify unexpected incident-related communications through their usual Maersk contact. Further confirmation from Maersk or additional findings from the investigation would help establish whether the reported gang claims, data volume and acquisition link are accurate.
Key Questions
What did Maersk confirm?
Maersk confirmed unauthorized access and data extraction from a local legacy system inherited through a previous acquisition. Its investigation is ongoing.
Did Maersk confirm the $5 million ransom demand?
No. BleepingComputer reported that WhiteArmor demanded $5 million, but Maersk’s advisory does not mention a ransom or confirm the group’s claims.
Were customer shipments or integrations disrupted?
Maersk said it had found no indication of an impact on other company systems or connected customer and partner systems, and did not anticipate operational disruption at the time of its advisory.
Was LF Logistics the acquired business involved?
That has not been established. BleepingComputer reported that WhiteArmor named an OCF/LF Logistics platform, but Maersk has not identified the acquisition or system involved.
What should Maersk customers do?
Maersk said customers can continue to use its platforms and should treat unexpected communications about the incident with caution, verifying them through their usual Maersk contact.
Source: Thorsten Meyer AI
