industrials-sector-threatransomware-group-operationbreach-disclosure-notification

Maersk Confirms Legacy-System Data Theft as WhiteArmor Claims $5 Million Ransom

Sector Threat Intelligence · 7 sources · Updated 2h ago · First seen Nov 11, 2026

A.P. Moller-Maersk confirmed that an attacker accessed a local legacy IT system inherited through an acquisition and extracted data. The shipping and logistics company said it secured the affected system and is investigating. Preliminary findings strongly suggest no sensitive data was disclosed, and Maersk has found no indication of compromise to its other systems or connected customer and partner systems. The company expects no operational disruption and said customers can continue booking and managing shipments normally.

Separately, the WhiteArmor ransomware group claimed it stole approximately 100 GB from the OCF/LF Logistics platform and demanded $5 million in bitcoin within 30 days. Its alleged haul includes driver records, plaintext passwords, privileged accounts, delivery receipts, inventory information, and mobile-device logs. Those claims remain unverified, and Maersk has not confirmed a connection between the group's allegations and its investigation. Customers should verify unexpected incident-related communications through their usual Maersk contacts, the company advised.

Who's targeting your sector?See the actors and campaigns active against you right now.

See sector threats

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · Jun 2017 – Nov 11, 2026

Reported Nov 11, 20264h ago
WhiteArmor claims 100 GB theft and demands $5 million
WhiteArmor listed Maersk on its leak site, claimed to have stolen approximately 100 GB from the OCF/LF Logistics platform, and demanded $5 million in bitcoin within 30 days under threat of publication. Its unverified claims included nearly 30,000 driver records, plaintext passwords, 33 SUPER_ADMIN accounts, delivery and inventory records, and 27,842 mobile device logs; Maersk had not confirmed a connection to its investigation.
Maersk hit by fresh cyber breach - Splash247
Reported Nov 11, 20264h ago
Maersk launches an investigation and secures the affected system
Maersk's cybersecurity team launched an investigation after discovering the intrusion and took steps to secure the affected legacy system.
Maersk hit by fresh cyber breach - Splash247
Reported Nov 11, 20264h ago
Attacker accesses an acquired Maersk legacy system and extracts data
An attacker accessed a local legacy IT system inherited through a previous acquisition and extracted data. Maersk did not identify the acquired business, specify the stolen data, or disclose when the intrusion occurred.
Maersk hit by fresh cyber breach - Splash247
Nov 11, 202621h ago
Maersk discloses incident and reports no indication of wider compromise
In a Wednesday statement, Maersk said preliminary findings strongly suggested no sensitive data had been disclosed and reported no indication of impact on other Maersk systems or connected customer and partner systems. The company said it expected no operational disruption and advised customers to verify unexpected incident-related communications.
Shipping giant Maersk probes 'IT security incident,' data theft
Oct 2026
WhiteArmor claims J.B. Hunt; company acknowledges unauthorized access
WhiteArmor claimed J.B. Hunt as a victim in late October 2026. J.B. Hunt subsequently acknowledged unauthorized access to information in an isolated part of its technology system, reported no operational disruption, and said it had notified law enforcement.
Maersk Confirms Data Theft as WhiteArmor Demands $5M
2022
Maersk acquires LF Logistics
Maersk acquired Hong Kong-based LF Logistics from Li & Fung Group for $3.6 billion. LF Logistics developed the OCF/LF Logistics platform that WhiteArmor later claimed to have compromised.
Maersk hit by fresh cyber breach - Splash247
2018
Maersk chair details extensive NotPetya recovery
Then-chair Jim Hagemann Snabe told World Economic Forum delegates that Maersk's recovery involved 4,000 new servers, 45,000 new PCs, and 2,500 applications over ten days.
Shipping giant Maersk probes 'IT security incident,' data theft
Jun 2017
NotPetya cripples Maersk's global IT operations
The NotPetya attack disrupted Maersk's container shipping and terminal operations worldwide. Maersk estimated losses of $250 million to $300 million.
Maersk hit by fresh cyber breach - Splash247

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Threat actors

1 linked

Whitearmor

Organizations

4 linked

AP Moller-MaerskA.P. Moller–MaerskLF LogisticsA.P. Moller – Maersk

Breaches

1 linked

APMOLLERMAERSK-2026-11

Do you run this?See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.

See Your Sector's Threats

Source coverage

Sources

7 references tracked. Mallory keeps watching after this page renders.

BreachnewsNews · Nov 11, 2026

Maersk Confirms Data Theft as WhiteArmor Demands $5MOpen source ↗

Splash247 NewsNews · Nov 11, 2026

Maersk hit by fresh cyber breach - Splash247Open source ↗

X DinosnNews · Nov 11, 2026

Dinosn: Maersk confirms data breach as WhiteArmor ransomware demands $5 million https://t.co/3FTwHvuvpnOpen source ↗

Bleeping ComputerNews · Nov 11, 2026

Maersk confirms data breach as WhiteArmor ransomware demands $5 millionOpen source ↗

X DinosnNews · Nov 11, 2026

Dinosn: Shipping giant Maersk probes 'IT security incident,' data theft https://t.co/shWSjsIXnCOpen source ↗

Shipping giant Maersk probes 'IT security incident,' data theftOpen source ↗

UnclassifiedNews · Nov 11, 2026

IT security incident | MaerskOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News