WhiteArmor Claims 100 GB Theft from Maersk Unit and Demands $5 Million

A.P. Moller Maersk says it identified an IT security incident involving unauthorized access and data extraction from one of its local legacy systems, inherited from a previous acquisition. In its statement of 11 November, Maersk said its findings so far strongly suggest no sensitive data has been disclosed, that the incident is isolated to that local system, and that it has found no indication of impact on other Maersk systems or on customer and partner systems connected through integrations such as APIs and EDI. The company said its cyber security team started a full investigation, which is ongoing.

The cybercrime group WhiteArmor has added Maersk to its Tor data leak site. According to Security Affairs, the group demanded a $5 million ransom in Bitcoin, giving Maersk 30 days to pay, and claims to have stolen about 100 GB of data from the OCF/LF Logistics platform. The attackers say the data includes nearly 30,000 driver records, passwords stored in plain text, 33 super admin accounts and signed delivery receipts. These claims come from the attackers and have not been independently verified, and Maersk's statement does not confirm them. Maersk acquired LF Logistics, the company that developed the platform, from the Li & Fung Group in 2022; the company has not confirmed a link between that platform and its reference to a legacy system.

למה זה חשוב For organizations that rely on inherited or acquired systems, this case shows how a legacy platform outside the main estate can become an entry point for extortion, even when the parent company reports no impact on its core systems. Security leaders should confirm which acquired platforms hold driver, credential and customer data, and whether they are covered by the same monitoring and access controls. Investigators should treat the leak-site claims as unverified until the victim or other sources confirm them, and track the claimed data categories separately from what the company has acknowledged.