WhiteArmor claims theft of 100GB from Maersk and demands ransom

Maersk confirmed an IT security incident involving unauthorised access and data extraction from a local legacy system inherited from a prior acquisition. In a statement issued on 11 November 2026, the company said the findings to date strongly suggest no sensitive data has been disclosed and that the incident is isolated to the affected, local system with no impact on other Maersk systems or customer and partner integrations such as APIs and EDI. It added that its cyber security team continues a full investigation and that the incident should not disrupt customer operations.

The security news outlet, WhiteArmor, asserts that about 100 GB of data was stolen from the OCF/LF Logistics platform and has demanded a ransom of $5 million in Bitcoin, giving Maersk 30 days to pay. WhiteArmor’s leak site claims the dumped data includes nearly 30,000 driver records, passwords stored in plain text, 33 super admin accounts, signed delivery receipts, inventory records, purchase orders, and mobile device logs containing phone numbers, emails and IMEI numbers.

Maersk’s public statement does not independently verify these claims. WhiteArmor notes that LF Logistics, acquired by Maersk in 2022, runs for contract-logistics operations for major brands, arguing the ransom represents roughly four hours of EBITDA. Maersk emphasises that it does not anticipate operational disruption and will inform affected parties if needed.