www.it-connect.fr
Maersk Confirms Data Breach as WhiteArmor Demands $5 Million
100 GB of data, 30 days to pay, and a $5 million ransom in bitcoins: that is the ultimatum issued by the WhiteArmor group to Danish shipping giant Maersk. The intrusion has been confirmed. Here is what we know.
On November 11, 2026, A.P. Moller-Maersk published a statement about a cybersecurity incident. Maersk acknowledges unauthorized access by a third party and a data breach. The compromised system was a "legacy" system inherited after an acquisition.
"At this stage, our findings strongly suggest that no sensitive data has been exposed," the company says. The incident appears to be isolated to this local system: no impact has been detected on Maersk's other systems, or on those of customers and partners connected via APIs or EDI (electronic data interchange). In other words, no operational disruption is expected.
As a reminder, Maersk operates more than 700 container vessels, is present in 130 countries, and employs more than 100,000 people. And this is not the first time Maersk has been hit by a cyberattack. The previous one was major. In 2017, NotPetya forced it to reinstall 45,000 workstations and 4,000 servers in about ten days, for losses estimated between $250 million and $300 million. A textbook case for disaster recovery planning (DRP) and business continuity planning (BCP).
The Data Claimed by WhiteArmor
Behind this cyberattack is the WhiteArmor ransomware gang: Maersk was added to its leak site over the weekend of November 7 and 8. The cybercriminals are demanding a hefty sum: $5 million in bitcoins, and Maersk has 30 days to pay the ransom. This amount was not chosen at random, because according to WhiteArmor, it would represent about four hours of EBITDA (earnings before interest, taxes, depreciation, and amortization) for Maersk's contract logistics business.
According to WhiteArmor, the data comes from the OCF/LF Logistics platform. Its original publisher, Hong Kong-based LF Logistics, was acquired by Maersk from Li & Fung for $3.6 billion. The deal was completed at the end of August 2022. The data leak reportedly represents about 100 GB of files, and here is what it allegedly contains:
- Drivers: nearly 30,000 driver records.
- Credentials: plaintext passwords, as well as 33 SUPER_ADMIN accounts for the platform.
- Logistics documents: signed delivery notes, purchase orders, and advance shipping notices.
- Mobile devices: 27,842 logs containing phone numbers, email addresses, and IMEI numbers.
For its part, Maersk has not specified the nature of the data or the date of the intrusion. Another important point: the statement does not mention data encryption. At this stage, the extortion is based solely on the threat of publishing the data. Even so, WhiteArmor is indeed associated with ransomware.
Legacy Systems from an Acquisition: A Classic Blind Spot
During an acquisition, the acquired company's systems are not always migrated or decommissioned quickly. They continue to run alongside the group's information system, with their own privileged accounts and their own security practices. If WhiteArmor's claims are confirmed, plaintext passwords on a platform still accessible four years after the acquisition would be a clear example of this technical debt.
Yet it is essential to carry out a full inventory after an acquisition: identify legacy applications and servers, identify administrator accounts tied to those platforms, and integrate them into the group's identity management process (MFA, regular access reviews), and so on.
