Overview
Shipping and logistics giant Maersk has confirmed that a threat actor accessed a local legacy system inherited through an earlier acquisition and extracted data from it. The WhiteArmor ransomware gang claimed the attack over the weekend, listed Maersk on its leak site, and is demanding $5 million in bitcoin with a 30-day deadline.
What Maersk Says
- The affected system is tied to the OCF/LF Logistics platform from the former LF Logistics, which Maersk acquired from Li & Fung Group in 2022.
- The investigation is ongoing, and current evidence indicates "no sensitive data has been disclosed."
- The incident is isolated to a local system, with no impact found on other Maersk systems or on customer and partner integrations (APIs, EDI).
- No operational disruption is expected, and customers will be notified as more information becomes available.
Maersk has not disclosed the intrusion date, the system's exact function, or the types of data taken.
What WhiteArmor Claims
The following claims are unverified:
- Roughly 100 GB of data
- Nearly 30,000 driver records
- Plaintext passwords and 33 SUPER_ADMIN accounts
- Signed delivery receipts and inventory data with purchase orders and ASNs
- About 27,842 mobile device logs containing phone numbers, emails, and IMEI numbers
The gang gave Maersk 30 days to make contact and pay.
Context
Maersk was previously hit by NotPetya in 2017, which forced it to rebuild around 4,000 servers and 45,000 workstations and cost up to $300 million. This incident looks very different in scale: a single legacy environment and data theft rather than destructive malware.
It does, however, show a recurring pattern: acquired and legacy systems often sit outside the main security program, with older credentials, weaker segmentation, and less monitoring.
Recommendations
For organizations that integrate acquired companies or run legacy platforms:
- Inventory inherited systems and bring them under central logging and EDR coverage.
- Eliminate plaintext credentials and review privileged accounts; remove stale super-admin accounts.
- Segment legacy environments from production networks and partner integrations.
- Monitor for data exfiltration from systems that rarely change.
- Prepare for third-party exposure. Driver, device, and contact data can fuel phishing and smishing against logistics partners.