WhiteArmor Demands $5 Million from Maersk, Claims Theft of 100GB of Data - Security Affairs

The Danish shipping giant A.P. Moller Maersk confirmed an IT security incident involving unauthorized access and data extraction from one of its local legacy systems, one inherited from a previous acquisition. The company stated that its cyber security team started a full investigation as soon as the problem was found and swift action secured the affected system.

Maersk’s findings so far strongly suggest no sensitive data has been disclosed, and the incident is isolated to that one local system. The company has found no sign that other Maersk systems were affected, or the customer and partner systems that connect to it through integrations such as APIs and EDI.

Maersk did not name the system, the type of data or the date of the intrusion. However, the cybercrime group WhiteArmor added the company to its Tor data leak site and demanded a $5 million ransom in Bitcoin, giving Maersk 30 days to pay.

Stolen data claims

The group claims to have stolen about 100 GB of data from the OCF/LF Logistics platform, which supports logistics and supply chain operations. Maersk acquired LF Logistics from the Li & Fung Group in 2022, which could match the company’s reference to an old system inherited through an acquisition, although the company has not confirmed this connection.

According to the attackers, the stolen data includes nearly 30,000 driver records, passwords stored in plain text, 33 super admin accounts and signed delivery receipts. The group also claims to have stolen inventory records, purchase orders, advance shipping notices and 27,842 mobile device logs containing phone numbers, email addresses and IMEI numbers.

These details come from the attackers and have not been independently verified. Maersk’s statement does not confirm their claims. WhiteArmor also tried to justify its demand, saying the $5 million ransom represents roughly four hours of revenue for the logistics business.

Company response and context

Maersk expects no disruption to operations for customers at this time, and customers can continue to use Maersk platforms to book and manage their shipments as usual. The company will keep customers updated as more relevant information becomes available, and if it identifies any need to inform impacted parties of any further findings, it will do so.

The scale of Maersk’s operations explains why this incident matters. A.P. Moller-Maersk is one of the world’s largest integrated shipping and logistics companies, playing a major role in global trade and supply chains. It operates around 700 container ships, representing approximately 13.5% of global container fleet capacity, and manages 60 terminals across 35 countries.

The company employs about 100,000 people in 130 countries and provides services covering ocean shipping, port operations, warehousing, customs clearance and end-to-end supply chain management. Maersk reported approximately $54 billion in revenue and $2.9 billion in net profit in 2025. Its global reach and reliance on interconnected IT systems make cybersecurity a major concern.

A breach involving even an older, locally operated platform could expose sensitive business and personal information, including data belonging to drivers, customers and logistics partners, even if the company’s main systems remain unaffected. In 2017, the NotPetya malware forced the company to reinstall more than 4,000 servers and 45,000 workstations from scratch, operating without IT for ten days and taking damages of up to $300 million.