Maersk Confirms Data Theft Amid $5 Million Extortion Attempt

Danish shipping giant Maersk has confirmed that attackers extracted data from a local IT system inherited from an earlier acquisition. The disclosure follows extortion claims by the WhiteArmor ransomware group, which demanded 5 million US dollars in bitcoin after allegedly obtaining 100GB of data. WhiteArmor claims the haul includes driver and staff records from a platform linked to LF Logistics, but Maersk stated its investigation strongly suggests no sensitive data has been disclosed. The carrier confirmed the incident remains isolated, with shipping operations and partner platforms connected via APIs and EDI functioning without disruption.

Key Facts

What Data Has Been Stolen?

Maersk states its findings strongly suggest no sensitive data has been disclosed, with the breach isolated to an inherited local system. However, the WhiteArmor ransomware group claims to hold roughly 100GB of exfiltrated data, including administrative credentials, driver profiles, delivery records, and mobile device logs.

According to WhiteArmor's leak site listing on November 7, the stolen files originate from a platform associated with LF Logistics, a Hong Kong-based logistics company acquired by Maersk in 2022. The extortionists claim the stolen cache contains roughly 29,000 driver records, of which 16,093 contain plaintext passwords, and 16,123 staff accounts, including 33 with superadministrator privileges. WhiteArmor also claims to possess delivery recipients, signed delivery receipts, inventory records, purchase orders, shipping notices, and over 27,000 mobile device logs containing phone numbers, email addresses and IMEI identifiers. Maersk has not confirmed WhiteArmor's involvement, nor has it verified the group's claims or identified what data was taken.

Maersk's internal investigation remains ongoing, and the claims made by the WhiteArmor group have not been independently verified.

Are Shipping Operations or Partner Networks Disrupted?

Maersk confirmed that its shipping platforms remain available for booking and managing shipments, with no operational disruptions anticipated for customers. The carrier reported finding no indication of an impact on other corporate environments or on customer and partner systems connected through APIs and EDI, as the breach was isolated locally.

The Danish shipping company explained that the compromised system was inherited through an earlier acquisition, though it has not publicly named the acquired business. After discovering the intrusion, Maersk's cybersecurity team launched an investigation and took immediate action to secure the affected environment. The WhiteArmor extortion group demanded USD 5,000,000 in bitcoin with a 30-day deadline, threatening to publish the alleged records, but the incident has not halted cargo bookings or partner integrations.

Maersk found no indication of an impact on customer and partner systems connected through APIs and EDI.

What Should You Do?

• Note that no software fix is available, as the intrusion involved an internal inherited system rather than a publicly disclosed software vulnerability.
• Ensure legacy and acquired IT systems are isolated from core enterprise networks and external partner integrations, such as APIs and EDI feeds.
• Monitor official communications from Maersk, as the company stated affected parties will be notified if necessary.
• Report suspected cyber-extortion or unauthorised network intrusions to Cyber999 via MyCERT.

Common Questions

How much ransom are the extortionists demanding?

The WhiteArmor ransomware group is demanding USD 5,000,000 in bitcoin. Threat actors listed Maersk on their leak site on November 7, giving the company a 30-day deadline to make contact and pay the ransom before they publish the stolen data.

Which acquired business is allegedly involved?

WhiteArmor claims the data was stolen from a platform tied to LF Logistics, a Hong Kong logistics firm acquired by Maersk in 2022. Maersk confirmed the affected system was inherited through an acquisition, but the company has not identified the specific acquired entity.

Has Maersk confirmed any data loss?

Maersk confirmed that attackers extracted data from a local IT system, but stated its findings strongly suggest no sensitive data has been disclosed. The company has not confirmed WhiteArmor's involvement or identified the specific types of data stolen during the intrusion.

Sources and Methodology

This dispatch is based entirely on reporting from SecurityWeek covering Maersk's November 11 statement. No other advisories, internal documents, or vendor pages were reviewed or independently verified for this report.