A.P. Moller-Maersk has confirmed that an attacker accessed and copied data from a system belonging to a company it acquired. An extortion group named WhiteArmor has listed Maersk on its leak site and is demanding 5 million dollars in bitcoin within 30 days.
What Maersk says
- The incident is limited to one legacy system.
- No effect has been found on other Maersk systems, or on customer and partner systems connected through APIs and EDI.
- Evidence so far suggests no sensitive data has been disclosed.
- Bookings and shipment management continue as normal.
The company has not named the system, the types of data involved, or the date of the intrusion.
What the attackers claim
WhiteArmor says it took about 100 GB from a logistics platform originally built by LF Logistics, which Maersk bought in 2022. Its list includes driver records, passwords stored in plain text, administrator accounts, signed delivery receipts and mobile device logs. None of this has been independently verified, and claims on leak sites are written to apply pressure.
The lesson: acquired systems
Whatever the final scope, the entry point fits a familiar pattern. Systems that arrive with an acquisition often sit outside the parent company’s patching, monitoring and identity controls for years. They are still connected, still hold real data, and nobody fully owns them.
Maersk knows the cost of a serious incident better than most. NotPetya in 2017 forced it to rebuild thousands of servers and tens of thousands of workstations.
Questions worth asking internally
- Which systems came from acquisitions or contractors, and who is accountable for each?
- Are they covered by the same logging and vulnerability management as everything else?
- Do any still store credentials in plain text?
- What would be lost if one of them were copied in full?