Maersk confirms a data breach as a ransomware gang demands $5 million

A.P. Moller-Maersk, one of the world's largest shipping and logistics companies, said on Wednesday that it is investigating an IT security incident in which data may have been stolen from a legacy system. The admission follows a claim by the WhiteArmor ransomware group, which listed Maersk on its leak site over the weekend and is demanding $5 million.

What Maersk has said

According to the company's statement, reported by The Register and BleepingComputer, Maersk started investigating as soon as it learned of the incident and secured the affected system. It describes that system as a legacy one it took on through an earlier acquisition, and says the problem is limited to that single local system.

Maersk says it has found no sign that other Maersk systems were touched, or that customer and partner systems linked to it through APIs and EDI (the electronic data interchange links that shippers use to swap bookings and documents) were affected. It says its findings so far "strongly suggest no sensitive data has been disclosed," and that it does not expect any disruption to operations. Customers can keep booking and managing shipments as usual.

The company has not said which system was breached, what kind of data was taken or when the intrusion happened. BleepingComputer says Maersk had not answered its questions by the time it published.

What the attackers claim

WhiteArmor's account is much more specific, though none of it has been independently confirmed. The group says it took roughly 100GB from Maersk's OCF/LF Logistics platform. Maersk bought LF Logistics, the company that originally built that platform, from the Li & Fung Group in 2022, which lines up with Maersk's description of a system inherited through an acquisition.

According to BleepingComputer, the gang claims the haul includes:

• nearly 30,000 driver records;
• plaintext passwords, including for 33 top-level "SUPER_ADMIN" accounts;
• signed delivery receipts;
• inventory records with purchase orders and advance shipping notices;
• 27,842 mobile device logs containing phone numbers, email addresses and IMEI numbers.

The group wants $5 million in bitcoin and has given Maersk 30 days to pay. In its note, it pitches the sum as about four hours of earnings for the contract logistics business that used to be LF Logistics.

A company that has been here before

Maersk is a household name in cybersecurity circles because of NotPetya, the destructive 2017 malware that Western intelligence agencies attributed to Russia's Sandworm group. The Register recalls that Maersk put the cost at around $300 million, and that its then-chair later described rebuilding 4,000 servers, 45,000 PCs and 2,500 applications in ten days. Today's incident looks very different: a data theft and extortion attempt rather than a wiper, and, by Maersk's account, contained to one system.

Why it matters

The detail worth watching is where this happened. Old platforms that come along with an acquisition are a common weak spot: they often keep their own accounts, older security practices and data that nobody has reviewed in years. If WhiteArmor's claim about plaintext admin passwords holds up, it would be a textbook example of that risk.

For now, the gap between the two accounts is wide. Maersk says nothing sensitive appears to have been disclosed; the gang says it has passwords and personal details of drivers and device users. Ransomware groups routinely exaggerate, and companies are often cautious early in an investigation, so the 30-day deadline is the next point at which more may come out.