Maersk Confirms Data Extraction From Acquired IT System Amid $5 Million Extortion Claim
Summary
Maersk confirmed data was extracted from an isolated IT system inherited through an acquisition. WhiteArmor claims it stole sensitive data and demands $5 million, but its involvement and claims remain unverified.
Key points
- Maersk said its cybersecurity team discovered an intrusion and confirmed data was extracted from a system inherited through an earlier acquisition.
- The company said the incident is isolated and it has found no indication of impact on other Maersk, customer, or partner systems.
- Maersk said its shipping platforms remain available and it does not anticipate disruption to customer operations.
- WhiteArmor listed Maersk on its leak site and claims to have taken about 100GB of data from a platform associated with LF Logistics.
- WhiteArmor demands $5 million and claims the data includes driver records, staff accounts, delivery information, and mobile-device logs.
- WhiteArmor’s involvement and data-theft claims have not been independently verified; Maersk has not disclosed the intrusion date or access method.
Article Details
- Victim Organization
- Maersk
- Incident Type
- Intrusion and data extraction from a local IT system; ransomware-group extortion claim
- Data Types Exposed
- Maersk confirmed data was extracted, but said its findings strongly suggested no sensitive data had been disclosed.
- WhiteArmor claimed the data included driver records, some containing plaintext passwords; staff accounts, including superadministrator accounts; delivery-recipient information; signed delivery receipts; inventory records; purchase orders; shipping notices; and mobile device logs containing phone numbers, email addresses, and IMEI identifiers. These details have not been independently verified.
- Affected Records
- WhiteArmor claimed approximately 29,000 driver records, including 16,093 with plaintext passwords; 16,123 staff accounts, including 33 with superadministrator privileges; and over 27,000 mobile device logs. The claims have not been independently verified.
- Affected Data Size
- WhiteArmor claimed approximately 100 GB of data; not independently verified.
- Operational Impact
- Maersk said the incident was isolated to a local system inherited through an acquisition, with no indication of impact to other Maersk systems or customer and partner systems connected through APIs and EDI. Maersk did not anticipate disruption to customer operations, and said its shipping platforms remained available.
- Ransom Or Extortion
- WhiteArmor listed Maersk on its leak site on November 7 and threatened to publish information unless Maersk paid $5 million in Bitcoin within 30 days. Maersk has not confirmed WhiteArmor’s involvement.
- Claim Status
- confirmed
Threat Actors
Countries
DenmarkIn a November 11 statement, the Danish company said the affected system was inherited through an earlier acquisition.Hong KongWhiteArmor claims to have obtained approximately 100GB of data from a platform associated with LF Logistics, a Hong Kong-based logistics company acquired by Maersk in 2022.
Industries
logisticsWhiteArmor claims to have obtained approximately 100GB of data from a platform associated with LF Logistics, a Hong Kong-based logistics company acquired by Maersk in 2022.ShippingShipping giant Maersk has confirmed that hackers extracted data from one of its IT systems, while an extortion group claims to have stolen sensitive information and is demanding $5 million.