World’s Second-Largest Container Line Maersk Confirms Cybersecurity Incident Involving Data Theft - Marine Insight

In a statement published on November 11, 2026, Maersk confirmed identifying an IT security incident. The company, one of the world's largest container carriers founded in 1904 and headquartered in Denmark, acknowledged that an attacker gained unauthorized access to one of its local legacy systems and extracted data.

WhiteArmor, a ransomware group, claimed responsibility for the attack and threatened to release about 100 GB of data from Maersk's OCF/LF Logistics platform. The hacker listed Maersk on its data leak site and publicly demanded $5 million as ransom, giving the company 30 days to pay in Bitcoin.

Data breach details

The hacker claimed to hold information about driver records, staff accounts, mobile logs, and delivery recipients' names and addresses. Specifically, they claimed to possess data including about 30,000 driver records, 27,842 mobile device logs, plaintext passwords, and signed delivery receipts.

WhiteArmor listed Maersk on its data leak site over the weekend and publicly demanded $5 million as ransom.

Previous incident

This isn't the first time Maersk has faced a major cyberattack. In 2017, the company was struck by the NotPetya ransomware, which forced it to operate without IT for ten days. According to reports, Maersk faced damages of up to $300 million and had to rebuild more than 4,000 servers and 45,000 workstations from scratch.

Current response

Maersk's official statement mentioned that a full investigation was immediately initiated and is currently ongoing. As of November 11, findings so far strongly suggest that no sensitive data have been disclosed. The company assured customers that they can keep using the platform for bookings and managing shipments.