Maersk discloses breach after extortion group demands $5m

Maersk has disclosed a data breach affecting one of its IT systems after an extortion group claimed to have stolen 100GB of logistics-related data. In a statement dated 11 November, Maersk said it “identified unauthorized access and data extraction,” but did not specify when the intrusion occurred. The incident is said to be isolated to a local legacy system from a prior acquisition, and Maersk stressed there is no indication that sensitive data has been disclosed beyond that environment. It also said there is no anticipated disruption to operations or impact on customer and partner systems connected via APIs or EDI.

WhiteArmor, a relatively new extortion group, claimed responsibility for the attack and posted screenshots of its leak site on X. The group demanded $5m in Bitcoin and purportedly has 100GB of data tied to Maersk’s OCF/LF logistics platform, including driver records, plaintext passwords, staff accounts, delivery receipts, purchase orders, inventories, and mobile device logs containing phone numbers, email addresses and IMEIs.

Nick Harris, CISO at Assured, noted publicly that WhiteArmor has pursued a string of extortion campaigns with victims in the logistics sector such as J.B. Hunt, Ryder and Echo Global Logistics, and is aiming to expand into ransomware, with an encryptor near completion. The reporting highlights that Maersk’s response discussions include reinforcing credential cycling, access controls, data loss alerts, and privacy around third parties, while investigators seek to determine what was accessed and how.