[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNITAuL5P5SPAlG5VC8i16Wcl_mjeFQS-s4igeNHH9O0":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"129066a4-746b-4993-9b10-a1921279d5bd","Hackers Breach Global Shipping Giant Maersk and Claim Theft of 100GB of Logistics Data","hackers-breach-global-shipping-giant-maersk-and-claim-theft-of-100gb-of-logistic-f23d70","A.P. Moller–Maersk has confirmed that hackers accessed an older IT system and extracted data, as a group calling itself WhiteArmor claims it stole 100GB of logistics records. The shipping giant disclosed the incident on November 11, 2026, but has not confirmed the attackers’ identity, the claimed data volume, or what was taken. In its official […] The post Hackers Breach Global Shipping Giant Maersk and Claim Theft of 100GB of Logistics Data appeared first on Cyber Security News.","A.P. Moller–Maersk confirmed on November 11, 2026 that hackers accessed an older IT system from a previous acquisition (LF Logistics), with a group calling itself WhiteArmor claiming theft of 100GB of logistics records including driver data, passwords, administrative accounts, and device identifiers. Maersk stated that no sensitive data has been disclosed based on findings so far, described the incident as isolated to one legacy system with no impact on other Maersk systems or customer\u002Fpartner connections, and reported no operational disruption expected. WhiteArmor demands $5 million in bitcoin within 30 days and claims the stolen data includes nearly 30,000 driver records, 33 top administrative accounts, purchase orders, and 27,842 mobile device logs with phone numbers and IMEI numbers, though these details remain unconfirmed.","WhiteArmor claims breach of Maersk legacy system with 100GB logistics data theft and $5M ransom demand.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-breach-maersk\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Breach-Global-Shipping-Giant-Maersk-and-Claim-Theft-of-100GB-of-Logistics-Data.webp","2026-11-12T10:10:00+00:00","2026-11-12T11:00:25.386325+00:00",8,[17,20,23,26],{"name":18,"type":19},"A.P. Moller–Maersk","vendor",{"name":21,"type":22},"LF Logistics","product",{"name":24,"type":25},"WhiteArmor","threat_actor",{"name":27,"type":28},"OCF\u002FLF Logistics platform","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":29,"icon":31,"name":32,"slug":33},null,"Breaches","breaches",[35,40,45],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21],{"controls":53,"vendors":140},[54,82,111],{"slug":55,"name":56,"problem":57,"products":58},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[59,66,74],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":61,"url":64,"description":65},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":83,"name":84,"problem":85,"products":86},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":112,"name":113,"problem":114,"products":115},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":151},"legacy-acquisition-system-exposes-maersk-to-data-theft-and-extortion","Legacy Acquisition System Exposes Maersk to Data Theft and Extortion","Hackers breached a legacy IT system inherited from LF Logistics, a company previously acquired by Maersk, stealing an alleged 100GB of sensitive logistics data including driver records, administrative credentials, and device identifiers. The root failure lies in inadequate security governance over acquired assets — systems brought in through mergers and acquisitions often retain outdated configurations, unpatched software, and stale privileged accounts that fall outside the acquiring company's standard security controls. The presence of 33 administrative accounts and plaintext or recoverable passwords in the stolen data suggests these legacy systems were never properly hardened or integrated into Maersk's identity governance program. This incident matters because attackers increasingly target the weakest link in a corporate portfolio, and legacy acquisition systems represent a predictable blind spot that threat actors actively exploit.",[146,147,148,149,150],"CIS Control 1: Inventory and Control of Enterprise Assets (v8)","CIS Control 5: Account Management (v8)","NIS2 Article 21(2)(d)","NIS2 Article 21(2)(i)","NIST SP 800-53 SA-9: External System Services",{"NIS2 Article 21(2)(d)":152,"NIS2 Article 21(2)(i)":153,"CIS Control 5: Account Management (v8)":154,"NIST SP 800-53 SA-9: External System Services":155,"CIS Control 1: Inventory and Control of Enterprise Assets (v8)":156},"NIS2 Article 21(2)(d) mandates supply chain security measures covering relationships with suppliers and third parties; the inherited LF Logistics system represents exactly the kind of acquired-entity risk that supply chain security policies must address.","NIS2 Article 21(2)(i) covers human resources security, access control, and asset management; the failure to govern administrative accounts and device credentials on the legacy system is a direct gap in access control and asset management obligations.","CIS Control 5 requires managing and controlling user accounts including privileged accounts; the exposure of 33 administrative accounts and passwords indicates these credentials were never reviewed or rotated after the acquisition.","NIST SP 800-53 SA-9 requires organizations to establish security requirements for systems inherited or integrated from external sources; applying this control to the acquisition integration process would have mandated a security assessment of the LF Logistics environment before it remained connected to Maersk infrastructure.","CIS Control 1 requires maintaining an accurate inventory of all enterprise assets; had the LF Logistics legacy system been properly catalogued and assessed post-acquisition, its security gaps would have been identified and addressed."]