A.P. Moller–Maersk, one of the world’s largest integrated shipping and logistics companies, has confirmed a cybersecurity incident involving unauthorised access to and data extraction from a legacy IT system inherited through a previous acquisition. The announcement follows claims by an emerging extortion group, WhiteArmor, that it had stolen approximately 100 GB of data from a logistics platform associated with Maersk’s operations.
In an official statement published on 11 November 2026, Maersk confirmed that an unauthorised party had accessed one of its local legacy systems and extracted data. The company’s cybersecurity team launched an investigation immediately after discovering the incident and took steps to secure the affected system.
According to Maersk, preliminary findings strongly suggest that no sensitive data has been disclosed. The company also stated that the incident appears to be isolated to the affected local system, with no indication of impact on other Maersk systems or customer and partner environments connected through integrations such as Application Programming Interfaces (APIs) and Electronic Data Interchange (EDI).
Maersk does not currently anticipate any disruption to customer operations. Its digital platforms remain available for booking and managing shipments as usual.
WhiteArmor Claims Theft of Approximately 100 GB of Data
The incident follows a post published on an extortion group’s leak site on 7 November 2026, in which WhiteArmor named Maersk as an alleged victim and claimed to have obtained approximately 100 GB of data from a contract-logistics platform associated with the former LF Logistics business, acquired by Maersk in 2022.
According to the threat actor’s claims, the allegedly compromised information includes:
- Driver records: 29,297 records, reportedly including 16,093 records containing plaintext passwords.
- Employee accounts: 16,123 accounts, including 33 accounts allegedly possessing high-level administrative privileges.
- Delivery recipient information: 18,913 records containing names and street addresses.
- Delivery documentation: 64,665 signed delivery receipts, with 214,107 documents reportedly in total.
- Warehouse and logistics data: Approximately 14.44 million inventory records, 189,248 purchase orders and 334,432 advance shipping notices.
- Mobile device information: 27,842 mobile-device logs allegedly containing personal contact details and device identifiers.
WhiteArmor reportedly demanded USD 5 million in Bitcoin, setting a 30-day deadline for Maersk to make contact and pay the ransom. The reported deadline is 7 December 2026.
It is important to distinguish between the threat actor’s allegations and the information confirmed by Maersk. Although the company has acknowledged unauthorised access and data extraction, it has not publicly attributed the incident to WhiteArmor or independently verified the volume, authenticity or contents of the allegedly stolen dataset.
Furthermore, the available information describes data theft and extortion rather than a confirmed ransomware deployment involving system encryption.
Legacy IT Systems and Acquisition-Related Cybersecurity Risks
The incident highlights an important cybersecurity challenge facing large maritime and logistics organisations: the management of legacy IT environments inherited through corporate acquisitions.
When companies acquire other businesses, they may also inherit their IT infrastructure, applications, user accounts, databases and existing security configurations. These environments can introduce additional cybersecurity risks, particularly when legacy systems are not fully integrated into the acquiring organisation’s security governance, monitoring and access-control processes.
In this case, Maersk has specifically identified the affected environment as a local legacy system originating from a previous acquisition. Although the company has stated that there is currently no indication of wider system impact, the incident demonstrates why inherited IT environments should remain within the scope of corporate cybersecurity risk assessments.
From a maritime cybersecurity perspective, this is particularly relevant to shipping companies operating complex digital ecosystems involving vessel operations, shore-based infrastructure, logistics platforms, third-party service providers and external business integrations.
Investigation Ongoing
Maersk has stated that its investigation remains ongoing and that it will provide further updates as relevant information becomes available. The company has also advised customers to exercise caution when receiving unexpected communications claiming to relate to the incident and to verify such communications through their usual Maersk contacts.
At this stage, several important questions remain unanswered, including the initial access method, the precise nature of the extracted information, the relationship between the confirmed incident and WhiteArmor’s claims, and whether any individuals or organisations will ultimately be identified as affected parties.
Official Maerks’ Statement: https://www.maersk.com/news/articles/2026/11/11/it-security-incident
