Maersk confirms security breach amid hacker claims of major data theft

A.P. Moller–Maersk has confirmed an IT security incident involving unauthorised access and data extraction from a legacy system, following claims by a hacker group that it obtained approximately 100 gigabytes of information linked to the shipping company’s logistics operations.

In a statement issued on 11 November, Maersk acknowledged that an unauthorised party had accessed a local system inherited through a acquisition. The Danish shipping group said its cybersecurity team immediately launched an investigation and took measures to secure the affected system.

The confirmation comes after a relatively unknown hacker group, WhiteArmor, claimed to have stolen extensive operational and personal information from a logistics platform associated with LF Logistics, the business acquired by Maersk in 2022.

Hackers claim access to extensive logistics data

According to Danish technology publication Ingeniøren, WhiteArmor claims to possess approximately 100 GB of data from a platform previously operated by LF Logistics, which is now integrated into Maersk’s warehousing and distribution operations.

The group alleges that the stolen information includes 29,297 driver profiles, of which 16,093 reportedly contain plaintext passwords, alongside 16,123 employee accounts, including 33 with elevated administrative privileges.

The alleged dataset also includes information relating to nearly 19,000 delivery recipients, more than 64,000 signed delivery receipts, approximately 14.44 million warehouse inventory records and hundreds of thousands of purchase orders and shipment notifications.

WhiteArmor has reportedly demanded approximately US$5 million in bitcoin, threatening to disclose the information unless payment is received by 7 December.

However, the authenticity and extent of the alleged data theft have not been independently verified, and Maersk has not publicly confirmed that WhiteArmor was responsible for the security incident.

Maersk reports no disruption to customer operations

In its official statement, Maersk said its preliminary investigation suggests that no sensitive data has been disclosed, despite confirming that data was extracted from the affected system.

“Our findings so far strongly suggest no sensitive data has been disclosed,” the company stated.

Maersk added that the incident appears to be isolated to the local legacy system, with no indication that other company systems or customer and partner platforms connected through APIs and electronic data interchange (EDI) have been affected.

The shipping group also indicated that it does not anticipate any disruption to customer operations, with its digital platforms remaining available for booking and managing shipments.

The company said it would continue investigating the incident and inform potentially affected parties if further findings make additional notifications necessary.

Investigation continues as questions remain over stolen data

The incident has drawn attention to potential cybersecurity vulnerabilities associated with legacy logistics platforms, particularly those incorporated into larger organisations following acquisitions.

According to cybersecurity specialists cited by Ingeniøren, WhiteArmor’s allegations appear credible, although the available information suggests a possible data theft and extortion incident rather than a conventional ransomware attack involving the encryption of systems.

Nevertheless, no independent confirmation has established a connection between the specific data allegedly held by WhiteArmor and the information Maersk has acknowledged was extracted.

Maersk has advised customers to remain cautious unexpected communications referencing the incident and to verify suspicious messages through their established company contacts.

The investigation remains ongoing, with the full extent of the incident and any potential exposure of customer or operational information yet to be established.