Maersk Investigates Data Theft From Legacy IT System as Hacker Group Seeks $5 Million

Maersk says a data breach affecting one legacy IT system has not disrupted container bookings, shipment tracking or other customer operations. The company is investigating unauthorized access to the system, which it said held data that was extracted. A group claiming responsibility is demanding $5 million in Bitcoin and says it took about 100 GB of files.

The incident puts attention on an older technology environment connected to a business Maersk previously acquired. The company has not confirmed that connection, the volume of data claimed stolen or the contents described by the group. For customers and logistics teams, those distinctions matter: the breach is confirmed, while key details about the data and its exposure remain unverified.

What Maersk has confirmed

In a statement on November 11, Maersk said unauthorized users accessed one of its legacy IT systems and extracted data. The system had come from a business acquired earlier. The company said its cybersecurity team began investigating after detecting the incident and took steps to secure the affected system.

Maersk described the breach as confined to a local system. Its initial investigation found no evidence that the intrusion had spread to other Maersk systems or to connected platforms used by customers and business partners. The company also said its early findings strongly indicated that sensitive data had not been disclosed.

That assessment is preliminary. Maersk said the investigation is continuing and that it would share new findings. Until the company establishes what files were accessed and whether any were disclosed, the scope of potential exposure remains uncertain.

Claims about the stolen files

BleepingComputer reported that a group calling itself WhiteArmor claimed responsibility. The group said it had taken approximately 100 GB of Maersk data and demanded $5 million worth of Bitcoin in exchange for not publishing it. Those figures and the group’s account have not been confirmed by Maersk.

The alleged file types could be operationally sensitive if the claims prove accurate. They reportedly include driver records, passwords, delivery documents, order information and logistics records. Such material can span personal details, access credentials and information about how freight moves through a company’s network. The available information does not establish which files, if any, were taken or whether credentials remain usable.

The system has been linked in reports to LF Logistics, the Hong Kong-based logistics company Maersk acquired for $3.6 billion in 2022. Maersk has not confirmed that the affected system was connected to LF Logistics. The connection therefore remains an allegation, rather than an established account of how the breach occurred.

Current operating picture

Maersk said customers can continue making container reservations and tracking shipments through its digital platforms. It does not expect disruption to operations from this incident. That gives shippers a clear immediate service picture, while the investigation works to determine whether the extracted data creates any further exposure.

For logistics teams, the distinction between an isolated legacy system and connected customer platforms is especially relevant. Maersk says it found no evidence of spread to those systems, and reports no interruption to the digital services customers use for bookings and tracking. The company’s findings so far describe the incident’s reach; they do not settle what data may have left the affected environment.

Teams that rely on the company’s platforms can continue using the services Maersk identified, while watching for new details about the investigation. If the reported data includes passwords or delivery records, the eventual scope and handling of those files would help clarify whether any follow-up is needed by customers, carriers or other business partners. No further operational steps for those groups were specified in the available information.

Why the 2017 incident is part of the comparison

The breach has revived memories of the NotPetya attack in June 2017, which significantly disabled Maersk’s global IT infrastructure. That incident caused serious disruption to container shipping and port terminal operations. Maersk later put its cost at between $250 million and $300 million.

The scale described for the current breach is different so far: Maersk says the affected system was local and reports no evidence of spread or customer service interruption. The 2017 episode explains why a cybersecurity incident at a major shipping group attracts close attention from logistics customers, but it does not establish that the present breach will have similar effects.

The next useful indicators are practical ones: whether Maersk confirms the system’s connection to LF Logistics, identifies the data involved, or revises its assessment of exposure. For now, the company’s reported operating position is that bookings and tracking remain available while its investigation continues.