Maersk confirms data theft after $5 million extortion attempt

Maersk has confirmed that data was extracted from a system inherited through an earlier acquisition, though the company has not named the acquired business. In a statement dated 11 November, the Danish shipping giant said its cybersecurity team detected an intrusion, initiated an investigation, and took steps to secure the affected system.

Maersk asserted that, so far, it sees no evidence that sensitive data has been disclosed and that the incident is localised to a single system with no impact on other Maersk networks or on customer and partner systems connected via APIs and EDI. The company said customer operations and shipping platforms remain available for bookings and management of shipments.

The disclosure follows a claim by the WhiteArmor ransomware group, which listed Maersk on its leak site on 7 November and sought a USD 5 million ransom. WhiteArmor says it obtained around 100GB of data from LF Logistics, a Hong Kong-based logistics company Maersk bought in 2022.

The alleged data include roughly 29,000 driver records (16,093 with plaintext passwords) and 16,123 staff accounts (including 33 with superadministrator rights), as well as delivery recipients’ information, signed delivery receipts, inventory records, purchase orders, and shipping notices. WhiteArmor also claims more than 27,000 mobile device logs containing phone numbers, email addresses and IMEI identifiers.

Maersk has not confirmed WhiteArmor’s involvement or detailed the data stolen, and has not said when the intrusion occurred or how access was gained; the investigation remains ongoing and affected parties will be notified if necessary.