Maersk Confirms Breach at Acquired Company as WhiteArmor Demands $5 Million
Summary
Maersk confirmed a breach involving a local system at an acquired company; its investigation is ongoing, and it says current evidence shows no sensitive data has been disclosed. WhiteArmor claims it stole about 100GB and demands $5 million.
Key points
- Maersk confirmed a threat actor breached systems at a company it previously acquired and stole data.
- Maersk says the incident is isolated to a local system, with no indication of impact to other Maersk or connected customer and partner systems.
- The investigation is ongoing; Maersk says current evidence indicates no sensitive data has been disclosed and does not expect operational disruption.
- WhiteArmor claims it holds about 100GB allegedly taken from the OCF/LF Logistics platform and demands $5 million.
- WhiteArmor claims the data includes driver records, plaintext passwords, privileged accounts, delivery receipts, inventory information, and mobile-device logs; these details are the actor's claims.
Article Details
- Victim Organization
- A.P. Moller–Maersk
- Incident Type
- Data breach involving a local system; WhiteArmor claimed data theft and ransomware extortion.
- Disclosure Date
- 2026-11-11
- Data Types Exposed
- WhiteArmor claims the data includes nearly 30,000 drivers' records, plaintext passwords, 33 SUPER_ADMIN accounts, signed delivery receipts, inventory rows with purchase orders and Advance Shipping Notices (ASNs), and 27,842 mobile-device logs containing phone numbers, email addresses, and IMEI numbers. These data types have not been confirmed by Maersk.
- Affected Records
- WhiteArmor claims to hold nearly 30,000 drivers' records, 33 SUPER_ADMIN accounts, and 27,842 mobile-device logs; Maersk has not confirmed these quantities.
- Affected Data Size
- WhiteArmor claims approximately 100 GB of data was stolen; Maersk has not confirmed this.
- Operational Impact
- Maersk confirmed a breach isolated to a local system. It said current evidence indicates no sensitive data has been disclosed, found no indication of impact to other Maersk, customer, or partner systems, and does not expect operational disruption.
- Ransom Or Extortion
- WhiteArmor publicly demanded USD 5,000,000 in bitcoin and gave Maersk 30 days to contact the group and pay. The demand accompanied the group's unverified claim that it stole approximately 100 GB of data.
- Claim Status
- claimed
Threat Actors
Products
Countries
Industries
logisticsRansomware group WhiteArmor claimed the attack over the weekend, threatening that it would release about 100GB of information allegedly exfiltrated from the company's logistics and supply-chain platform.ShippingShipping giant Maersk has confirmed that a threat actor breached systems belonging to a company it previously acquired and stole data.