Hackers Breach Global Shipping Giant Maersk and Claim Theft of 100GB of Logistics Data
WhiteArmor claims breach of Maersk legacy system with 100GB logistics data theft and $5M ransom demand.
A.P. Moller–Maersk confirmed on November 11, 2026 that hackers accessed an older IT system from a previous acquisition (LF Logistics), with a group calling itself WhiteArmor claiming theft of 100GB of logistics records including driver data, passwords, administrative accounts, and device identifiers. Maersk stated that no sensitive data has been disclosed based on findings so far, described the incident as isolated to one legacy system with no impact on other Maersk systems or customer/partner connections, and reported no operational disruption expected. WhiteArmor demands $5 million in bitcoin within 30 days and claims the stolen data includes nearly 30,000 driver records, 33 top administrative accounts, purchase orders, and 27,842 mobile device logs with phone numbers and IMEI numbers, though these details remain unconfirmed.
AI summary of the linked source. Not reviewed by an editor. How this works
Run A.P. Moller–Maersk?
Get an email when a new story names A.P. Moller–Maersk, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonHackers breached a legacy IT system inherited from LF Logistics, a company previously acquired by Maersk, stealing an alleged 100GB of sensitive logistics data including driver records, administrative credentials, and device identifiers. The root failure lies in inadequate security governance over acquired assets — systems brought in through mergers and acquisitions often retain outdated configurations, unpatched software, and stale privileged accounts that fall outside the acquiring company's standard security controls. The presence of 33 administrative accounts and plaintext or recoverable passwords in the stolen data suggests these legacy systems were never properly hardened or integrated into Maersk's identity governance program. This incident matters because attackers increasingly target the weakest link in a corporate portfolio, and legacy acquisition systems represent a predictable blind spot that threat actors actively exploit.
What helps against this
How we list vendors- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.