Maersk has confirmed that an intruder pulled data out of an old system it acquired with another business, though it says its main platforms and customer connections were not affected. A ransomware crew calling itself WhiteArmor says it holds 100GB and wants $5m, a claim that has not been independently verified.
What happened
On Wednesday 11 November 2026, the Danish shipping and logistics group A.P. Moller-Maersk said it was investigating an IT security incident. According to the company, an unauthorised party got into a local legacy system and extracted data from it. Maersk says the system came to it through an earlier acquisition. It did not say which one.
Maersk says it started an investigation straight away and has secured the affected system. Its early findings, it says, point strongly towards no sensitive data having been exposed. The company describes the incident as “isolated to a local system”, in the words reported by Reuters. It says it has seen nothing to suggest that other Maersk systems were affected, or that customer and partner systems linked to it through APIs and EDI were touched. The company anticipates no operational disruption, and customers can keep booking and managing shipments as normal.
Maersk has not said what data was taken or how much. It has told customers to check any unexpected message about the incident with their usual Maersk contact before acting on it.
A group calling itself WhiteArmor has claimed responsibility, but the claim is unverified. Breachsense, which monitors leak sites, records the WhiteArmor listing for Maersk as discovered on 9 November. As reported by BleepingComputer and others, the group says it took around 100GB from the OCF/LF Logistics platform. It says the haul includes driver records, passwords, and delivery and inventory data, and it is demanding $5m in bitcoin within 30 days. Maersk has not confirmed that the claim relates to its investigation. Maersk bought the Hong Kong-based contract logistics firm LF Logistics in 2022 for about $3.6bn, which would fit the description of an inherited system. Until Maersk or the investigators say so, that link is the attacker’s version of events and should be treated with caution.
The technical picture
Very little technical detail has been released: not the entry point, the dwell time, or whether anything was encrypted. Still, Maersk’s description points to a familiar weak spot. Acquired platforms often run for years beside the parent company’s main estate. They tend to keep their own identity stores, their own patching cycle and their own network paths, and the security team does not always own them in practice.
WhiteArmor is not a new name in the logistics sector. In October 2026 it claimed the American freight company J.B. Hunt, which confirmed that an intruder had reached a segregated section of its IT systems. Two logistics claims in a few weeks suggest a sector focus, though no shared entry point has been shown.
Breachsense, which tracks leaked credentials, lists thousands of maersk.com logins in infostealer logs, though it stresses these are not necessarily linked to this attack. Stolen logins plus an inherited system with weaker controls is an obvious way in for any large organisation.
Why it matters for UK organisations
Maersk is one of the biggest carriers serving UK ports, and a great many British importers, exporters and freight forwarders rely on its booking and tracking platforms. The UK also has a history with this company. After the 2017 NotPetya attack, which Maersk estimated cost it around $300m, staff at its Maidenhead command centre played a key part in the recovery. This time, operations appear unaffected.
The bigger risk for UK customers is fraud. If the stolen material does include delivery records, driver details or contact data, it is exactly the kind of context criminals use to make invoice redirection and fake shipping notices believable. Maersk’s own advice to confirm unexpected messages through known contacts is sensible and worth passing on to finance and procurement teams.
There is also a lesson for UK boards. Mergers and acquisitions remain busy across British business, and many acquired companies are left running their own IT long after the deal completes. Under UK GDPR, the buyer is accountable for personal data it now controls, including data held in systems nobody has looked at since completion. The Cyber Security and Resilience Bill will also raise expectations on organisations in scope to understand and manage the systems they depend on.
Expert view
In my experience, inherited estates are among the most reliable routes into large organisations during a test. The parent company has usually done the hard work on its core platforms: single sign-on, MFA, EDR and centralised logging. The subsidiary that joined three or four years earlier often has none of that. It keeps a separate directory, a few service accounts with passwords that never expire, and a firewall rule someone added during integration and forgot. The system simply sits in a gap between teams.
Maersk deserves credit for disclosing quickly, and for apparently containing the intrusion to the legacy system, which suggests the segmentation held. The important unanswered question is what the data actually covers. “No sensitive data” is a preliminary judgement, and early assessments in data theft cases are often revised once the stolen files have been fully reviewed. I would watch for any follow-up statement and any sign that WhiteArmor publishes samples.
I would also be careful not to over-read the gang’s numbers. Ransomware groups inflate volumes and data types to increase pressure, and a 30-day bitcoin deadline is standard extortion theatre. Equally, the apparent lack of operational disruption does not make the theft trivial for the people whose records may be in it.
What to do now
- Warn finance and logistics teams. Tell staff who deal with Maersk, or with any freight provider, to verify changes to bank details or delivery instructions by calling a known contact. Do not use the contact details in the message itself.
- Inventory inherited systems. List every platform that came with an acquisition, who owns it, where it connects and whether it is still needed. Decommission anything that is not.
- Bring acquired estates up to baseline. Apply the Cyber Essentials controls as a minimum: secure configuration, timely patching, user access control with MFA, malware protection and firewalls. Prioritise internet-facing services.
- Review identities and secrets. Rotate service account passwords and API keys on legacy platforms, remove dormant accounts, and check infostealer and leaked-credential feeds for your domains.
- Check segmentation and monitoring. Confirm that legacy systems cannot reach core networks or partner connections such as EDI and APIs without control, and that their logs reach your SOC.
- Build security into deals. Make cyber due diligence and a funded post-completion remediation plan standard parts of every acquisition.
Bottom line
Maersk appears to have contained a breach of a legacy corner of its estate without the turmoil of 2017, and it was quick to say so publicly. WhiteArmor’s claims are still unproven. For UK organisations the practical message is simple: the systems you inherit are now your responsibility, and attackers know which ones are least looked after. Find those systems, fix them or switch them off, and warn your people about follow-on fraud.
Sources
- The Register: Shipping giant Maersk probes ‘IT security incident,’ data theft
- BleepingComputer: Maersk confirms data breach as WhiteArmor ransomware demands $5 million
- Egyptian Gazette (Reuters): Shipping firm Maersk investigates IT security incident
- The IT Nerd: Maersk confirms cyberattack involving data theft from legacy system
- Mallory: Maersk Confirms Legacy-System Data Theft as WhiteArmor Claims $5 Million Ransom
- Breachsense: Maersk data breach
