Cyber Intrusion at A.P. Moller–Maersk
A.P. Moller–Maersk has confirmed that an unauthorized entity penetrated an older IT system, resulting in the extraction of sensitive data. The group, which identifies itself as WhiteArmor, has purportedly stolen 100GB of logistics records.
This breach was publicly acknowledged on November 11, 2026. However, the shipping conglomerate has refrained from specifying the identity of the attackers, the authenticity of the claimed data volume, or the nature of the retrieved information.
In its official security announcement, Maersk stated that the compromised system was inherited from a previous acquisition.
The company’s cybersecurity unit promptly initiated an investigation upon discovering the breach and implemented measures to fortify the system’s security, with the investigation still underway.
According to a report by BleepingComputer, WhiteArmor has listed Maersk on its leak platform and is demanding a ransom of $5 million in bitcoin within a 30-day timeframe.
The group asserts that the purloined files originated from the OCF/LF Logistics platform, which facilitates logistics and supply chain operations. Notably, Maersk acquired LF Logistics from Li & Fung in 2022.
The purported data haul includes:
- Approximately 30,000 driver records
- Passwords stored in plain text
- 33 accounts with elevated administrative privileges
- Signed delivery receipts
- Purchase orders and shipment notifications
- 27,842 mobile device logs featuring phone numbers, email addresses, and IMEI numbers
Nevertheless, these claims remain unverified and require further investigation.
Intrusion into a Global Shipping Leader: Maersk
Maersk has neither confirmed a direct correlation between WhiteArmor nor the LF Logistics platform in its ongoing inquiry. A statement from the company substantiates that unauthorized access and data exfiltration did occur.
However, Maersk has not disclosed details concerning the specific files that were compromised, how the hackers infiltrated the system, or when this breach commenced. Current evidence does not suggest that ransomware was employed to encrypt any systems.
According to Maersk, “Our findings thus far strongly indicate that no sensitive data has been disclosed.”
The company has characterized the incident as localized to a single legacy system, asserting that there is no indication of a broader effect on other Maersk systems or those of its customers and partners, including interfaces like application programming interfaces (APIs) and electronic data interchange (EDI).
Customers may continue utilizing Maersk platforms to schedule and administer shipments. The company does not foresee operational disruptions and commits to updating stakeholders as more data becomes accessible. If further discoveries necessitate it, Maersk will notify affected parties accordingly.
This incident aligns with a pattern of cybersecurity breaches plaguing shipping providers. Notably, prior reports from Cybersecurity News have highlighted incidents such as the CEVA Logistics breach, which impacted Valve customers, and the ShipMonk breach, which involved Trezor customer records.
While these occurrences illustrate how delivery data stored externally can be jeopardized, no connections to the Maersk breach have been established.
In light of this breach, Maersk encourages customers to exercise vigilance regarding unexpected communications about the incident and to verify their authenticity through established company contacts.
At present, confirmed facts are limited to unauthorized access and data extraction from one outdated system.
The asserted theft of 100GB, the ransom demand, and the alleged sensitive records necessitate thorough verification while investigators elucidate the full extent of this incident.
Source link: Cybersecuritynews.com.
