Maersk confirms data theft from legacy system as WhiteArmor demands US$5m ransom

Danish shipping group A.P. Moller-Maersk (Maersk) has confirmed that an attacker gained unauthorised access to one of its legacy IT systems and extracted data. The confirmation came days after a ransomware group publicly claimed it had breached the company.

The group calls itself WhiteArmor. It says it stole about 100GB of data from a platform linked to LF Logistics, the Hong Kong-based contract logistics firm Maersk acquired in 2022. It is demanding US$5 million in bitcoin.

In a statement on 11 November 2026, Maersk said its findings so far “strongly suggest no sensitive data has been disclosed”. The company said it did not expect any disruption to customer operations.

Maersk says the incident is isolated

Maersk said its cybersecurity team found the intrusion, began an investigation and acted to secure the affected system. It said the system came from a previous acquisition. The investigation is still under way.

“The incident is isolated to a local system,” the company said.

Maersk added that it had found no sign of impact on its other systems. It also found no sign of impact on customer and partner systems linked to Maersk through application programming interfaces (APIs) and electronic data interchange (EDI).

Maersk said customers can keep using its platforms to book and manage shipments as usual.

According to SecurityWeek, Maersk has not confirmed that WhiteArmor was involved. It has not named the acquired business or said what types of data were taken. It has also not said when or how the intrusion happened.

The company said it would notify affected parties if necessary.

WhiteArmor’s claims

WhiteArmor listed Maersk on its data leak site on 7 November 2026. The group calls the affected platform “OCF/LF Logistics”.

SecurityWeek and the Danish engineering publication Ingeniøren reported that the group claims to hold 29,297 driver profiles. It says 16,093 of these contain passwords stored in plain text.

The group also claims to hold 16,123 staff accounts, including 33 with super-administrator privileges. US technology publication BleepingComputer also reported the administrator account claim.

According to Ingeniøren, the group also claims to have the names and addresses of 18,913 delivery recipients and 64,665 signed proofs of delivery.

The claimed data further includes about 14.44 million warehouse records, 189,248 purchase orders and 334,432 advance shipping notices, Ingeniøren reported.

The group also says it holds more than 27,000 mobile device logs. These reportedly contain phone numbers, email addresses and International Mobile Equipment Identity (IMEI) numbers.

“You have 30 days to contact us and pay USD 5,000,000 in bitcoin,” the group said in its extortion message, as quoted by SecurityWeek.

Ingeniøren reported that the countdown on the leak site points to a deadline of 7 December. The group has said it will publish the data if Maersk does not pay.

According to the French IT publication IT-Connect, WhiteArmor claims the sum equals roughly four hours of earnings for Maersk’s contract logistics business.

None of the group’s claims has been independently verified. Ingeniøren said it could not verify an image the group posted that appeared to show a list of email accounts and passwords.

A little-known group

Ingeniøren described WhiteArmor as a new and relatively unknown group. It reported that the group also claims to have stolen data from Unilever and Hisense.

The publication also reported that the group’s leak site offers to pay insiders at large companies for access to internal systems.

Thomas “Mannie” Wilkans is head of research and threat intelligence at security firm Lab-1. He told Ingeniøren that the group’s post appeared credible.

Wilkans said the incident looked more like pure data theft than a classic ransomware attack, because the group did not appear to have encrypted Maersk’s systems. He said there was no evidence so far of an insider at Maersk.

Dray Agha is senior manager for tactical response at cybersecurity firm Huntress. He told Seatrade Maritime that legacy systems can reveal security flaws that had not been seen before.

“Maersk has demonstrated the value of network segmentation by containing this data theft to a local platform without interrupting core shipping operations,” Agha said.

The LF Logistics acquisition

Maersk completed its US$3.6 billion purchase of LF Logistics, formerly part of the Li & Fung group, on 31 August 2022.

The deal added 223 warehouses and about 10,000 employees in 14 Asian countries to Maersk’s network.

The purchase was part of Maersk’s strategy to grow beyond ocean shipping into end-to-end logistics, with a focus on consumer markets in the Asia-Pacific. LF Logistics was later rebranded as Maersk.

Memories of NotPetya

The incident recalls the NotPetya attack of June 2017. That malware spread through compromised Ukrainian accounting software and crippled Maersk’s global IT systems.

According to The Maritime Executive, the 2017 attack disrupted Maersk’s port terminal operations around the world for weeks. It cost the company at least US$300 million.