"Our findings so far strongly suggest no sensitive data has been disclosed," the company said, in an initial public account of what it called "an IT security incident."
Maersk's statement and immediate steps
Denmark-based shipping, cargo, and logistics giant A.P. Moller‑Maersk said on Wednesday that it has launched an investigation into an IT security incident involving the potential theft of data. In its statement the company said it "immediately launched an investigation into the attack and the affected system was secured." Maersk added that "Cybersecurity remains a constant, ongoing priority for Maersk" and described having "rigorous processes in place to identify and prevent incidents and minimize customer impact."
The affected legacy local system — "from a previous acquisition"
Maersk identified the target as a legacy local system and explicitly described it as one "from a previous acquisition." The company said the incident is "isolated to a local system" and that there is "no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI."
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadOperational continuity: customers can continue to use Maersk platforms
The company told customers they should be able to continue to use Maersk platforms to manage shipments "as usual" and that they should "expect updates from the company as and when they're available." Maersk also advised recipients to treat "any unexpected communications claiming to relate to this matter with caution and verify them through your usual Maersk contact." The firm said it does not expect the attack to have an effect on operations.
Comparing this intrusion to the NotPetya disaster of 2017
The wording of Maersk's disclosure prompted comparisons with the company's 2017 experience: the statement and available details suggest the current intrusion is not of the same scale as the NotPetya disaster. The Register's account recalls that NotPetya, a destructive wiper that mimicked the Petya ransomware strain, "wormed its way across the global economy." Western intelligence agencies attributed that malware to Russia's Sandworm group, which they said is believed to be part of the country's military intelligence service (GRU).
Maersk previously told the market that the cost of the 2017 attack was expected to be about $300 million in remediation and rebuild costs. Jim Hagemann Snabe, then chair of Maersk, told delegates at the World Economic Forum in 2018 that the company’s rebuild after NotPetya encompassed "4,000 new servers, 45,000 new PCs, and 2,500 applications" and that work had been completed over ten days. The Register also noted that in 2020 Maersk laid off around 150 staffers from its command and control center in Maidenhead, England — staff who had played key roles in the earlier recovery.
What this means for security teams, Maersk customers, and recovery staff
- Security teams and technologists: Maersk’s emphasis that the incident is "isolated to a local system" and that there is "no indication" of impact on API and EDI integrations focuses attention on containment and scope verification. Security teams will watch for follow‑up reporting from Maersk that confirms whether sensitive categories of data were involved and for any indicators of compromise that could affect connected systems.
- Maersk customers and partners: Customers were explicitly reassured they can continue to manage shipments through Maersk platforms and were warned to verify any unexpected communications through their usual Maersk contact. That guidance centers the immediate customer concern on the authenticity of outbound messaging and continuity of booking and tracking functions.
- Operations and recovery staff: The company's invocation of past recovery scale — the 2017 rebuild figures and the later staffing changes disclosed by The Register — frames an institutional memory: Maersk has previously mobilized major rebuilds and subsequently reorganized parts of its command and control structure. Those facts will inform how Maersk stages remediation and whether it calls on retained or external teams to support the investigation.
At present, Maersk's public account is focused and narrow: the affected system has been secured, investigators remain active, and the company says there is no current evidence of broader impact. The next factual milestones to watch will be Maersk's updates on the investigation, any confirmation about the nature of the data involved, and whether further operational effects emerge as the probe continues.
