Maersk: legacy-system breach confirmed; WhiteArmor claims ~100GB stolen and demands $5M
Severity: medium · Patch status: unknown · Since 2026-11-11
On 2026-11-11 Maersk confirmed unauthorised access to, and data extraction from, one of its local legacy systems inherited from a previous acquisition. It says the investigation is ongoing, that its findings so far strongly suggest no sensitive data has been disclosed, that the incident is isolated to that system, and that customer and partner integrations (APIs and EDI) show no impact and operations are not expected to be disrupted. The WhiteArmor group listed Maersk on its leak site around 2026-11-07 and demands USD 5 million in bitcoin within 30 days, claiming about 100 GB from an OCF/LF Logistics platform. The contents it lists (about 29,000 driver records with plaintext passwords for about 16,000 of them, 33 super-admin accounts, delivery receipts, inventory and purchase-order data, and device logs with phone numbers and IMEIs) are the group's own claims and are not verified. BleepingComputer ties the system to LF Logistics, which Maersk acquired in 2022, but Maersk has not named it, and it has not named WhiteArmor either.
What to do
- Verify any message about this incident through your usual Maersk contact. Maersk asks customers to treat unexpected communications with caution.
- If you hold a Maersk or LF Logistics platform account, reset passwords reused on that platform and watch for unusual logins. The plaintext-password claim is unverified.
- Review API and EDI integration logs with Maersk for anomalies. Maersk reports no impact on those integrations so far.
- Harden legacy systems inherited through acquisitions and audit privileged (admin) accounts.
- Ensure offline backups and ransomware response plans are current.
Sources
All live incidents on Threat Watch
