Maersk Confirms Data Theft Amid $5 Million Extortion Attempt

In a November 11 statement, the Danish company revealed the affected system was inherited through an earlier acquisition, though it did not identify which business was compromised. Maersk's cybersecurity team discovered the intrusion and has taken steps to secure the system, with an ongoing investigation.

The company maintains no sensitive data has been disclosed, emphasizing the incident is isolated to a local system with no impact on other Maersk systems or customer/partner connections through APIs and EDI. Maersk assures customers that shipping platforms remain fully operational with no disruptions expected.

Ransomware Claims

The disclosure follows claims by the WhiteArmor ransomware group, which listed Maersk on its leak site on November 7 and threatened to publish stolen information unless a $5 million ransom is paid. The group alleges it obtained approximately 100GB of data from LF Logistics, acquired by Maersk in 2022.

WhiteArmor claims to possess 29,000 driver records (16,093 with plaintext passwords), 16,123 staff accounts (33 with superadmin privileges), delivery recipient information, signed receipts, inventory records, purchase orders, shipping notices, and over 27,000 mobile device logs containing personal identifiers.

Investigation Continues

Maersk has not confirmed WhiteArmor's involvement or identified the types of data stolen, nor has it disclosed when the intrusion occurred or how attackers gained access. The company's investigation remains ongoing, with notifications to affected parties planned if necessary.