Maersk Discloses Data Breach After WhiteArmor Ransomware Attack

"The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI," Maersk said in its disclosure.

WhiteArmor posts Maersk to its leak site and demands $5 million

Over the weekend the ransomware group WhiteArmor listed Maersk on its public data-leak site and issued an extortion demand: "You have 30 days to contact us and pay USD 5,000,000 in bitcoin," the group wrote. In the same posting the threat actor framed the demand against Maersk’s contract-logistics arm — the "former LF Logistics" — claiming this business "runs fulfilment for many of the world's largest consumer brands" and adding rhetorically that "Five million dollars is roughly four hours of that EBITDA." WhiteArmor also said it holds roughly 100 GB of data allegedly taken from Maersk’s OCF/LF Logistics platform.

What the attackers say they took from the OCF/LF Logistics platform

WhiteArmor detailed a list of allegedly exfiltrated items that it claims to be using to support its extortion demand. According to the group's announcement, the haul includes nearly 30,000 driver records, plaintext passwords, 33 SUPER_ADMIN accounts, signed delivery receipts, and "14.44 inventory rows with purchase orders and Advance Shipping Notice (ASNs)." The group also asserts possession of 27,842 mobile device logs that include phone numbers, emails, and IMEI numbers.

Maersk’s public assessment: isolated to a local system, no sensitive data disclosed so far

Maersk confirmed that a threat actor breached systems belonging to a company it previously acquired and that data was stolen, but described the incident as isolated. The company said current evidence indicates "no sensitive data has been disclosed," and that it does not expect disruptions to operations. Maersk assured customers they can continue booking and managing shipments through its systems as usual.

Maersk declined to share further technical detail in its disclosure: it did not name the affected system, specify the types of compromised data beyond the general statements, or say when the intrusion occurred. BleepingComputer reached out to Maersk with additional questions but had not heard back as of publishing.

How security teams, Maersk customers, and regulators are likely to react

• Security teams and incident responders: Will treat the report as a local-system compromise of an acquired platform (OCF/LF Logistics) and focus triage on account privileges, plaintext password exposure, and SUPER_ADMIN access claims. Teams will also verify Maersk's assertion that APIs and EDI integrations remain unaffected.
• Maersk customers and logistics partners: Will watch for direct notifications. Maersk said it will notify customers "as more relevant information becomes available, and if we identify any need to inform impacted parties of any further findings," and advised customers to "treat any unexpected communications claiming to relate to this matter with caution and verify them through your usual Maersk contact."
• Regulators, insurers, and risk managers: Will note both the specifics of WhiteArmor’s public demand and Maersk’s assessment that no sensitive data has been disclosed, and will monitor whether further disclosures or notifications become necessary under applicable reporting requirements.

Context inside Maersk's global footprint and past disruptions

The company named in the incident, A.P. Moller–Maersk, operates ocean freighters, port terminals, warehouses, and air and land transport services across 130 countries. Maersk has 700 container ships (roughly 13.5% of global fleet capacity), 60 terminals in 35 countries, and employs 100,000 people. In its most recent year reported in the disclosure, Maersk posted $54 billion in revenue and $2.9 billion in net profit.

The company’s disclosure also referenced a precedent: In 2017 Maersk was hit by NotPetya ransomware, an event that forced the company to rebuild more than 4,000 servers and 45,000 workstations from scratch, operate without IT for ten days, and incur damages of up to $300 million. That history underscores why both the threat actor’s public posting and Maersk’s statements will be watched closely by customers and the market.

WhiteArmor’s public timetable gives Maersk 30 days to respond and a $5,000,000 bitcoin ransom as the group's immediate demand; Maersk has said the incident is isolated and that customers should continue to use its systems. The company also pledged to notify customers "as more relevant information becomes available" and to inform impacted parties if further findings warrant it. Observers will be watching for confirmation of which local system was compromised, a technical timeline of the intrusion, and whether any of the specific data types WhiteArmor claims to hold are independently validated or disclosed.

Source: BleepingComputer — Maersk confirms data breach as WhiteArmor ransomware demands $5 million