TL;DR
Maersk says an intruder accessed and extracted data from a local legacy system inherited through a previous acquisition. BleepingComputer reports that a group called WhiteArmor claims to have about 100 GB of data and is demanding $5 million, but Maersk has not confirmed the group’s claims or named the affected system.
A.P. Moller–Maersk says attackers accessed and extracted data from a local legacy system inherited through a previous acquisition, and that its investigation is ongoing. BleepingComputer separately reports that a ransomware group called WhiteArmor claims to have taken about 100 GB and is demanding $5 million; Maersk has not confirmed those claims, and says it does not anticipate disruption to customer operations.
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
In an advisory titled “IT security incident,” Maersk said its cybersecurity team discovered the issue, launched a full investigation and took swift action to secure the affected system. The company described the system as local and tied to a previous acquisition. It has not identified the system, the acquisition or when the intrusion occurred.
Maersk said its findings so far “strongly suggest no sensitive data has been disclosed.” The company also said it had found no indication of an impact on other Maersk systems or on customer and partner systems connected through integrations such as APIs and EDI. It said customers can continue to use its platforms to book and manage shipments as usual.
The ransom and data-volume figures come from BleepingComputer’s November 11 report, which attributed them to WhiteArmor’s leak-site listing. The report says the group named a platform it called “OCF/LF Logistics” and gave Maersk 30 days to pay in bitcoin. Those are the group’s claims as reported by the publication, not details Maersk has verified publicly. BleepingComputer said it had asked Maersk for more information and had not received a response by publication.
What Shippers Should Know
For businesses using Maersk, the immediate operational message is that the company does not anticipate disruption and says its booking and shipment-management platforms remain available. Maersk has also reported no indication that connected customer or partner systems were affected. These statements describe its findings at the time of the advisory; the investigation is still underway.
The incident also matters because data extraction is distinct from public disclosure. Maersk says data was taken, while its statement says current findings strongly suggest no sensitive data has been disclosed. The company has not defined “sensitive” in the advisory or explained whether “disclosed” refers to publication, access by the intruders, or another form of release. Readers should not treat the wording as proof that no information was accessed or copied.
For customers, Maersk’s practical guidance is to be cautious about unexpected messages claiming to relate to the incident and verify them through their usual Maersk contact. This is relevant while the details are unsettled: an unverified ransom report may prompt inquiries or messages that appear to be connected to the event.
Products Worth Considering
LG UltraGear evo 27-inch 5K Mini-LED Gaming Monitor
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
The Legacy System Link
Maersk’s advisory says the affected system came from “a previous acquisition,” but does not name the business. BleepingComputer’s report links WhiteArmor’s claim to LF Logistics. Maersk completed its purchase of LF Logistics on August 31, 2022, describing it as a Hong Kong-based contract logistics company focused on services including omnichannel fulfilment, e-commerce and inland transport in Asia-Pacific.
At the time of the deal, Maersk said LF Logistics had 223 warehouses and 10,000 employees, and that the acquisition would bring its global facilities total to 549. This establishes the scale of that acquisition, not that its systems were involved in the current incident. Only the attackers’ reported claim connects the incident to LF Logistics; Maersk has not made that identification.
Maersk’s November 11 advisory and the BleepingComputer report provide different kinds of information: the company describes its investigation and current assessment, while the publication reports the group’s statements. Reuters also reported Maersk’s advisory on November 11. The available source material does not establish whether the two reports share additional independent confirmation of the ransom claim.
““unauthorised access and data extraction from one of our local legacy systems from a previous acquisition.””
— Maersk
The System and Data Remain Unknown
Maersk has not said which acquired business or local system was affected, when the intrusion took place, what categories of data were extracted or how many people or organisations may be involved. The advisory also does not provide a technical account of how access occurred or say whether the investigation has identified the intruder.
It is not yet clear whether WhiteArmor’s reported claim is accurate. Maersk has not publicly confirmed the group’s identity, its claimed access to approximately 100 GB, its reference to LF Logistics or the reported $5 million demand. Nor has Maersk said that the data was published. The status and terms of any alleged negotiation are unknown.
The statement about no sensitive data being disclosed is Maersk’s assessment based on findings so far. Because the inquiry remains open and the company has not explained what it counts as sensitive or disclosed, the full data impact cannot yet be assessed from the public information.
Maersk Says Updates Will Follow
Maersk said it will update customers as more relevant information becomes available and inform impacted parties if it finds that necessary. The next useful details would include the affected system and acquisition, the types of data involved, and whether Maersk can substantiate or rule out the claims reported by BleepingComputer.
Until then, Maersk advises customers to continue using its platforms as usual and to treat unexpected communications that claim to relate to the incident with caution. Customers should verify such messages through their normal Maersk contact. No date for a further update or completion of the investigation has been announced.
Key Questions
Did Maersk confirm a $5 million ransom demand?
No. BleepingComputer reported that WhiteArmor demanded $5 million. Maersk’s advisory does not mention a ransom or confirm the group’s claim.
What does Maersk say was affected?
Maersk says there was unauthorised access and data extraction from a local legacy system from a previous acquisition. It has not named the system or acquisition.
Are Maersk customers’ shipments disrupted?
Maersk says it does not anticipate disruption at this time and that customers can continue booking and managing shipments on its platforms. It also reports no indication of impact on customer and partner connections such as APIs and EDI.
Has Maersk said what data was taken?
No. Maersk has not identified the data types. Its statement says findings so far strongly suggest no sensitive data has been disclosed, while confirming that data was extracted.
Source: Thorsten Meyer AI
