Maersk Confirms IT Security Incident After Hacker Group Claims 100GB Data Theft

Shipping and logistics giant A.P. Moller-Maersk has confirmed an IT security incident involving unauthorised access to, and data extraction from, one of its older systems. The company issued its statement on Wednesday, November 11, shortly after a Danish technology outlet reported that a hacker group was claiming to hold a large cache of Maersk data.

What Maersk has confirmed

According to Maersk , the affected system is a legacy platform inherited through a acquisition and used in a limited, local part of its business. The company says it moved quickly to launch an investigation and secure the system. Its early findings strongly suggest that no sensitive data has been disclosed.

Maersk also stressed that the incident is isolated to that single local system. It has found no sign of any impact on other Maersk systems, or on customer and partner systems that connect to it through integrations such as APIs and EDI. The company says there has been no disruption to operations and that customers can keep using its platforms to book and manage shipments as normal. Customers have been advised to treat any unexpected communication the incident with caution and to verify it through their usual Maersk .

What the hackers are claiming

The claims come from WhiteArmor, a relatively new extortion group that only began operating a few weeks ago and currently lists a small number of victims on its leak site. On November 7, the group listed Maersk and said it had taken roughly 100GB of data from a contract-logistics platform linked to Maersk 's former LF Logistics business. The group says the material includes driver records, staff accounts, delivery receipts, and credentials. It is demanding $5 million in Bitcoin and has set a deadline of December 7, after which it says it will publish the data.

These details are the group's own assertions. Maersk has not confirmed that WhiteArmor was responsible, and it has not verified the size or contents of the alleged data set. No independent evidence has been published to prove what was taken. Cybersecurity specialists quoted by the Danish outlet Ingeniøren say the group's listing appears credible, and that the pattern looks like data theft and extortion rather than a conventional ransomware attack that encrypts systems.

For anyone in shipping, the word " Maersk " to "cyber attack" brings back the NotPetya outbreak of 2017, when malware spread across the company's global network, knocked out terminals and booking systems, and cost the group an estimated $300 million. This incident looks very different. Nothing so far suggests systems were encrypted, vessels or terminals were affected, or customers lost access to services. The concern here is the exposure of data, not an operational shutdown.

Why it matters for the industry

The case highlights a familiar weak spot for large logistics groups: legacy systems that come along with acquisitions. Platforms built by other companies can stay in use for years, often with older security controls and credentials that are harder to monitor. For a business that has grown through large logistics deals, integrating and securing those systems is as important as integrating the operations behind them.

It is also a reminder that supply chain data, including driver details, staff accounts, and delivery records, has real value to criminals. Even when core booking and shipping platforms are untouched, leaked credentials can be reused for phishing or fraud against customers, partners, and drivers.

What shippers and forwarders should do

Treat unexpected emails or calls that mention the Maersk incident as suspicious, and verify them through your usual Maersk .

Check that any shared logins or integrations with logistics partners use unique passwords and multi-factor authentication.

Review which third-party and legacy systems hold your shipment, driver, and customer data.

Watch for official updates from Maersk , as the investigation is still ongoing.

Maersk confirmed unauthorised access and data extraction from a legacy system inherited through an acquisition.

The hacker group WhiteArmor claims to have taken 100GB and is demanding $5 million in Bitcoin by December 7.

Maersk says there is no operational disruption and no sign that other systems or customer integrations were affected.

The group's claims and Maersk 's confirmed incident have not been independently linked.

The incident appears to be data theft and extortion, not a repeat of the 2017 NotPetya shutdown.

For freight forwarders and shippers, the practical lesson is simple: operations are running normally, but staying alert to phishing and tightening access to partner systems is sensible while the investigation continues.