Maersk confirms data breach as WhiteArmor ransomware demands $5 million - BleepingComputer
Danish shipping giant Maersk has confirmed that a threat actor breached systems belonging to a company it previously acquired and stole data, while the ransomware group WhiteArmor demands $5 million.
The investigation into the incident is ongoing, but the shipping firm says that current evidence indicates that "no sensitive data has been disclosed." Maersk added that it does not expect disruptions to operations, and assures customers that they can continue booking and managing shipments through its systems as usual.
The company stated that the incident is isolated to a local system and that it has found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI.
"The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI," Maersk states.
A.P. Moller–Maersk is a Danish shipping and logistics group and one of the world’s largest container carriers by fleet capacity. The company operates ocean freighters, port terminals, warehouses, and air and land transport services across 130 countries.
It has 700 container ships, roughly 13.5% of the global fleet capacity, 60 terminals in 35 countries, and employs 100,000 people. Last year, Maersk reported $54 billion in revenue and $2.9 billion in net profit.
Ransomware gang claims 100GB data theft
Over the weekend, the WhiteArmor ransomware gang listed Maersk on its data leak site and publicly asked for a ransom payment of $5 million. "Your contract-logistics arm, the former LF Logistics, runs fulfilment for many of the world's largest consumer brands. Five million dollars is roughly four hours of that EBITDA," the threat actor said.
WhiteArmor claims to hold approximately 100 GB of data allegedly stolen from Maersk's OCF/LF Logistics platform, which the group is using to support its extortion demands.
"You have 30 days to contact us and pay USD 5,000,000 in bitcoin," reads WhiteArmor's public message.
According to the threat actor, the data they hold includes nearly 30,000 drivers records, plaintext passwords, 33 SUPER_ADMIN accounts (the most privileged on a system), signed delivery receipts, and 14.44 inventory rows with purchase orders and Advance Shipping Notice (ASNs).
The hacker also claims to hold 27,842 mobile device logs that include phone numbers, emails, and IMEI (International Mobile Equipment Identity) numbers.
Maersk advises caution on communications
Maersk noted in the disclosure today that "the incident is isolated to a local system" and that it would notify customers "as more relevant information becomes available, and if we identify any need to inform impacted parties of any further findings."
As always, please treat any unexpected communications claiming to relate to this matter with caution and verify them through your usual Maersk contact, the company advises.
In 2017, Maersk was hit by NotPetya ransomware, forcing it to rebuild an infrastructure of over 4,000 servers and 45,000 workstations from scratch. At the time, the company was forced to operate without IT for ten days, incurring damages of up to $300 million.
Related
