A.P. Moller–Maersk has confirmed a cybersecurity breach involving unauthorized access and data extraction from a legacy, locally hosted system, after a hacker group claimed to have stolen roughly 100GB of logistics data linked to the company’s operations.
The Danish shipping group said an unauthorized party accessed a local system inherited through a prior acquisition and that its cybersecurity team immediately launched an investigation and took steps to secure the affected system. Maersk said its preliminary findings “strongly suggest no sensitive data has been disclosed,” while acknowledging that data was extracted. The company has not confirmed the identity of the attacker and said neither the authenticity nor the full extent of the alleged data theft has been independently established.
A relatively unknown hacking group calling itself WhiteArmor has claimed it obtained a substantial volume of operational and personal data from a logistics platform formerly operated by LF Logistics, which Maersk acquired in 2022. Reporting by a Danish technology publication stated the hackers allege the haul includes 29,297 driver profiles (16,093 reportedly containing passwords stored in plaintext), 16,123 employee accounts including 33 with elevated administrative privileges, details of nearly 19,000 delivery recipients, more than 64,000 signed delivery receipts, approximately 14.44 million warehouse inventory records and hundreds of thousands of purchase orders and shipment notifications.
WhiteArmor has reportedly demanded around US$5 million in bitcoin and threatened to release the information if payment is not made by 7 December. However, Maersk has not confirmed that WhiteArmor was responsible for the breach, and no independent evidence has yet established that the data allegedly held by WhiteArmor is the same information Maersk confirmed was extracted.
Some cybersecurity specialists cited by the Danish publication consider the hackers’ claims credible. The available evidence has been described as pointing toward data theft and extortion rather than a conventional ransomware attack that encrypts systems.
Maersk response and customer guidance
Maersk said the incident appears confined to the local legacy system and that there is no indication its wider corporate infrastructure or customer and partner platforms connected through application programming interfaces (APIs) and electronic data interchange (EDI) were compromised. The company does not anticipate disruption to customer operations and said its digital platforms remain available for booking and managing shipments.
Investigations are continuing and Maersk said potentially affected parties would be notified if subsequent findings warrant further communication. The company urged customers to exercise caution over unexpected communications referencing the incident and to verify suspicious messages through established company contacts.
The disclosure has renewed concerns about cybersecurity risks tied to legacy technology, particularly systems inherited during corporate acquisitions. With the investigation ongoing, questions remain about the exact volume and nature of the information accessed, the potential exposure of individuals and business partners, and whether the alleged ransom threat will lead to publication of stolen data.
