WhiteArmor Demands $5 Million from Maersk, Claims Theft of 100GB of Data

Maersk confirms a data breach involving a legacy system, while WhiteArmor claims 100GB of stolen data and demands a $5 million ransom.

A.P. Moller Maersk, the Danish shipping giant, says it identified an IT security incident involving unauthorized access and data extraction from one of its local legacy systems, one inherited from a previous acquisition.

“Maersk has identified an IT security incident involving unauthorised access and data extraction from one of our local legacy systems from a previous acquisition.” reads the statement published by Maersk on November 11. “Our findings so far strongly suggest no sensitive data has been disclosed. The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI.”

According to Maersk, its cyber security team started a full investigation as soon as it found the problem, and it’s still going. The company says swift action secured the affected system. Its findings so far strongly suggest no sensitive data has been disclosed, and it says the incident is isolated to that one local system.

Maersk has found no sign that other Maersk systems were affected, or the customer and partner systems that connect to it through integrations such as APIs and EDI. It doesn’t expect disruption for customers, who can book and manage shipments as usual. It promises updates and says it will inform any affected parties if it finds a need to.

Maersk didn’t name the system, the type of data or the date of the intrusion. However, the cybercrime group WhiteArmor added the company to its Tor data leak site:

WhiteArmor demanded a $5 million ransom in Bitcoin, giving Maersk 30 days to pay. The group claims to have stolen about 100 GB of data from the OCF/LF Logistics platform, which supports logistics and supply chain operations.

“”Your contract-logistics arm, the former LF Logistics, runs fulfilment for many of the world’s largest consumer brands,” states the leak site. “Five million dollars is roughly four hours of that EBITDA.””

Maersk acquired LF Logistics, the company that developed the platform, from the Li & Fung Group in 2022. This could match Maersk’s reference to an old system inherited through an acquisition, although the company has not confirmed this connection.

According to the attackers, the stolen data includes nearly 30,000 driver records, passwords stored in plain text, 33 super admin accounts and signed delivery receipts. The group also claims to have stolen inventory records, purchase orders, advance shipping notices and 27,842 mobile device logs containing phone numbers, email addresses and IMEI numbers. These details come from the attackers and have not been independently verified. Maersk’s statement does not confirm their claims. WhiteArmor also tried to justify its demand, saying the $5 million ransom represents roughly four hours of revenue for the logistics business.

“We do not anticipate disruption to operations for customers at this time, and customers can continue to use Maersk platforms to book and manage their shipments as usual.” concludes the statement. “We will keep customers updated as more relevant information becomes available, and if we identify any need to inform impacted parties of any further findings, we will do so.”

The scale of Maersk’s operations explains why this incident matters. A.P. Moller-Maersk is one of the world’s largest integrated shipping and logistics companies, playing a major role in global trade and supply chains. It operates around 700 container ships, representing approximately 13.5% of global container fleet capacity, and manages 60 terminals across 35 countries. The company employs about 100,000 people in 130 countries and provides services covering ocean shipping, port operations, warehousing, customs clearance and end-to-end supply chain management.

Maersk reported approximately $54 billion in revenue and $2.9 billion in net profit in 2025. Its global reach and reliance on interconnected IT systems make cybersecurity a major concern. A breach involving even an older, locally operated platform could expose sensitive business and personal information, including data belonging to drivers, customers and logistics partners, even if the company’s main systems remain unaffected.

In 2017, NotPetya forced the company to reinstall more than 4,000 servers and 45,000 workstations from scratch. It operated without IT for ten days and took damages of up to $300 million.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)