Maersk Says Hackers Took Data From a System It Inherited Through an Acquisition. A Ransomware Gang Wants $5 Million: Your Questions Answered
Shipping giant Maersk has confirmed that data was taken from an isolated system that came with an earlier acquisition, while the WhiteArmor gang claims about 100GB from the former LF Logistics platform and demands $5 million. Here is what is confirmed, what is only claimed, and the lesson for any company that buys another.
One of the world’s biggest container carriers is dealing with a data theft that started not in its core systems but in a platform it picked up when it bought another company. Here are the key questions, answered with what is actually on the record.
The answers draw on BleepingComputer’s report on the Maersk breach and SecurityWeek’s coverage.
What did Maersk actually confirm?
In a statement dated November 11, the Danish shipping and logistics group said an attacker breached and took data from a system that came to Maersk through an earlier acquisition. The company did not name that business. It said the incident is isolated to a local system, that its findings so far strongly suggest no sensitive data was disclosed, and that it has seen no sign of impact on other Maersk systems or on customer and partner connections that use APIs and EDI.
Are shipments affected?
Maersk says it does not expect operational disruption, and customers can keep booking and managing shipments as usual.
Who is claiming responsibility, and what do they say they have?
A ransomware group calling itself WhiteArmor listed Maersk on its leak site on November 7, according to SecurityWeek. The group says it holds roughly 100GB taken from a platform tied to LF Logistics, the Hong Kong-based logistics business Maersk acquired from Li & Fung in 2022. Its claims include about 29,000 driver records, more than 16,000 of them with passwords stored in plain text, some 16,000 staff accounts including 33 with top-level administrator rights, delivery receipts, purchase orders, shipping notices and more than 27,000 mobile device logs containing phone numbers, email addresses and IMEI numbers.
Is any of that verified?
No. SecurityWeek notes that the group’s claims have not been independently verified, and Maersk has neither confirmed WhiteArmor’s involvement nor described what kinds of data were taken. Maersk also has not said when the intrusion happened or how the attackers got in.
How much are they asking for?
WhiteArmor’s public message demands $5 million in bitcoin and gives the company 30 days to make contact.
What is Maersk telling customers?
The company says it will notify affected parties if its investigation finds a need to, and it asks customers to treat any unexpected message claiming to relate to the incident with caution and to verify it through their usual Maersk contact. That advice matters: publicized breaches are routinely followed by scam emails that borrow the victim’s name.
Hasn’t Maersk been here before?
Yes. In 2017 the NotPetya attack forced Maersk to rebuild thousands of servers and workstations and run without IT for about ten days, with losses BleepingComputer puts at up to $300 million. This incident, by the company’s account, is far narrower.
What this means for your company
The detail worth noticing is where the trouble began: a system that arrived with an acquisition. Whenever a business buys another company, merges with one or takes over a client’s old platform, it inherits that system’s accounts, passwords and gaps along with its data. A practical habit is to inventory every inherited system, reset or retire its administrator accounts, confirm how passwords are stored, and either bring it up to your own security standard or shut it down on a set date. In the meantime, warn your staff that “breach update” emails from any well-known vendor deserve a second look before anyone clicks.
Taking on an older system through an acquisition, or still running one nobody fully owns? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
