Skip to content
Maersk Investigates Data Breach Linked to WhiteArmor Ransomware Group

Maersk Investigates Data Breach Linked to WhiteArmor Ransomware Group

First seen 11 Nov 2026, 17:03 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 12, 2026 at 03:13 UTC
  • •Maersk confirmed unauthorized access to a legacy system, with no operational disruption reported.
  • •WhiteArmor claims to have stolen 100GB of data and is demanding a $5 million ransom.
  • •Initial assessments indicate no sensitive data has been disclosed, and the incident is isolated.

A.P. Moller-Maersk confirmed a cybersecurity incident involving unauthorized access to a legacy system inherited from a prior acquisition. The hacker group WhiteArmor claims to have stolen approximately 100GB of data, including driver records and passwords, and is demanding a ransom of $5 million in Bitcoin. Maersk's initial findings suggest no sensitive data has been disclosed and that the incident is contained to a single local system, with no impact on other systems or operations. The company has launched an investigation and is working with cybersecurity experts to assess the situation. Customers can continue using Maersk's services without disruption. The incident recalls the 2017 NotPetya attack that severely affected Maersk's operations.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 7h ago How this analysis works

Timeline

2026-11-11
Maersk confirms IT security incident
Maersk announced unauthorized access to a legacy system and initiated an investigation.
Navilinkglobal
2026-11-11
WhiteArmor claims responsibility
The ransomware group WhiteArmor claimed to have stolen 100GB of data from Maersk and demanded a ransom.
Securityaffairs
2026-11-11
Maersk reassures customers
Maersk stated that there is no expected disruption to operations and customers can continue using its platforms.
Bleepingcomputer

More articles in this cluster (22)

Following this threat?

Track notpetya and A.P. Moller-Maersk in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 4

Common questions

What data was reportedly stolen?
WhiteArmor claims to have stolen 100GB of data, including driver records, passwords, and delivery receipts.
Is there any impact on Maersk's operations?
No, Maersk has stated that there is no expected disruption to its operations or services.
What should customers do in response?
Customers are advised to remain vigilant and verify any unexpected communications related to the incident.