Maersk Says Recent Cyber Incident Affected Legacy System

Danish shipping company Maersk has confirmed that threat actors accessed a legacy system originating from a previous acquisition. The company stated that the security incident remains isolated to a local environment, with no indication of impact on core systems, customer networks, or partner integrations using APIs and EDI. Maersk noted that findings show no sensitive data was disclosed and anticipates no operational disruptions for its customers. The disclosure follows claims by the WhiteArmor ransomware gang that it breached Maersk subsidiary LF Logistics, demanding a ransom and alleging the theft of internal records.

Key Facts

What Systems Were Impacted by the Incident?

The intrusion was confined exclusively to an isolated local legacy system acquired during Maersk's 2022 purchase of LF Logistics. Maersk confirmed that core maritime infrastructure, central operational platforms, and external integrations—including customer Application Programming Interfaces and Electronic Data Interchange connections—remained entirely unaffected by the compromise.

The company explained that internal investigations have revealed no evidence that sensitive corporate or customer records were compromised during the unauthorised access. However, the announcement arrived three days following public claims by the WhiteArmor ransomware group, which asserted it had infiltrated Hong Kong-based LF Logistics. The extortion group claimed to have exfiltrated 100GB of records, allegedly including data on drivers, warehouses, and customers, issuing a $5 million ransom demand payable within 30 days.

Maersk reported that the breach was restricted to a single local legacy environment with no disruption to customer-facing services.

How Does This Reflect Wider Threats to the Maritime Sector?

Global logistics and maritime transport networks face persistent targeting from ransomware syndicates as supply chain operations increasingly digitalise. Recent attacks on major port facilities in South America, North America, Europe, and Asia demonstrate systemic vulnerabilities across critical shipping hubs, causing significant disruptions to cargo routing, billing, and scheduling workflows.

The incident at Maersk coincides with a severe cyberattack against Brazil's Santos Port Authority, South America's largest port facility. That attack caused an electrical outage, compelled personnel to switch to manual route scheduling and billing, and severely delayed cargo loading operations before administrators restored approximately 70% of systems using backups. Similar incidents have disrupted international transit hubs over the past five years, including a 2024 ransomware incident at the Port of Seattle where administrators refused extortion demands.

Ransomware attacks against international ports and logistics operators have repeatedly forced transport facilities to revert to manual operational processes.

What Should You Do?

• Note that no vendor patch or software update has been issued, as the incident was confined to a legacy network environment.
• Maintain and routinely test verified offline backups to support recovery, mirroring the response of the Santos Port Authority.
• Ensure acquired legacy assets are segmented from core enterprise networks, external APIs, and Electronic Data Interchange systems.
• Malaysian organisations experiencing cyber incidents or anomalous activity can lodge reports with Cyber999 via MyCERT for operational guidance.

Common Questions

Was customer data compromised in the Maersk incident?

According to Maersk, internal findings indicate that no sensitive data has been disclosed, and no disruption to customer operations is expected. However, the WhiteArmor ransomware gang claimed it stole 100GB of LF Logistics data, including warehouse, driver, and customer details.

What ransom demands were made by the threat actors?

The WhiteArmor ransomware group demanded a $5 million payment within a 30-day window following its claimed intrusion into LF Logistics. Maersk did not confirm the extortion demands but stated the incident remained isolated to a local legacy system.

Did the breach disrupt external partner connections or APIs?

Maersk confirmed there is no indication that the incident impacted customer or partner systems communicating via integrations such as APIs or Electronic Data Interchange (EDI). All external connections to broader company infrastructure remained secure and unaffected.

Sources and Methodology

This dispatch is based entirely on reporting published by The Record from Recorded Future News by Jonathan Greig. ROCKSTARmedia Infosec has not reviewed external advisories, third-party vendor bulletins, or additional documentation for this report.