A.P. Moller-Maersk confirmed this week that threat actors breached an older local system belonging to a previously acquired business unit. Over the weekend, WhiteArmor claimed responsibility, alleging it exfiltrated approximately 100GB of sensitive supply-chain and logistics records and demanded a $5 million Bitcoin ransom. Maersk emphasized that its core global shipping networks remain fully operational.
According to Maersk’s security disclosure, incident response teams immediately isolated the compromised legacy environment upon detecting unauthorized access. The Copenhagen-based carrier stated that current evidence indicates no sensitive customer data has been disclosed, while forensic investigations remain ongoing; bookings, port terminal operations and logistics tracking continue functioning normally across all 130 operating countries. In a statement cited by BleepingComputer, Maersk said: "The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI." Operating 700 container vessels representing 13.5 percent of global fleet capacity, Maersk generated $54 billion in revenue last year.
WhiteArmor alleged that the exfiltrated files originated from the OCF/LF Logistics platform, originally developed by LF Logistics before Maersk acquired the contract logistics firm from the Li & Fung Group in 2022. WhiteArmor gave Maersk a 30-day deadline to pay $5 million in Bitcoin, claiming the sum equaled roughly four hours of the division’s earnings before interest, taxes, depreciation, and amortization. According to technical listings reviewed by TechRadar and BleepingComputer, WhiteArmor claims to possess nearly 30,000 driver records, plaintext user passwords, 33 privileged SUPER_ADMIN accounts, and signed delivery receipts. The extortionists also allege possession of 14.44 million inventory rows detailing purchase orders and advance shipping notices, alongside 27,842 mobile device logs containing employee phone numbers, email addresses, and IMEI hardware identifiers.
