[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fS5-15GAEqWRfvaZssmBs-UIxHqmD8PlDRumRRMe73BM":3},{"article":4,"iocs":44,"watch_terms":48,"solutions":49,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"3f8c07f4-57df-47b6-ae66-55cde75114ed","Maersk Confirms Data Theft Amid $5 Million Extortion Attempt","maersk-confirms-data-theft-amid-5-million-extortion-attempt-c94635","The WhiteArmor ransomware group claims it stole 100GB of data from the shipping giant’s systems. The post Maersk Confirms Data Theft Amid $5 Million Extortion Attempt appeared first on SecurityWeek.","Shipping giant Maersk confirmed a data breach impacting an IT system inherited from an acquisition. The WhiteArmor ransomware group claims to have stolen 100GB of data, including driver and staff records, and is demanding a $5 million ransom. Maersk stated the incident is isolated and does not anticipate disruptions to customer operations.","Maersk confirms data theft after ransomware group claims $5M extortion attempt.","https:\u002F\u002Fwww.securityweek.com\u002Fmaersk-confirms-data-theft-amid-5-million-extortion-attempt\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FMaersk.jpeg","2026-11-12T08:38:47+00:00","2026-11-12T09:00:15.966013+00:00",8,[17,20,23],{"name":18,"type":19},"Maersk","vendor",{"name":21,"type":22},"WhiteArmor","threat_actor",{"name":24,"type":25},"LF Logistics","product","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":26,"icon":28,"name":29,"slug":30},null,"Ransomware","ransomware",[32,37,39],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":46,"value":21,"context":47},"malware","Ransomware group claiming responsibility for the data theft.",[18,24],{"controls":50,"vendors":137},[51,79,108],{"slug":52,"name":53,"problem":54,"products":55},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[56,64,71],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":66,"url":69,"description":70},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":80,"name":81,"problem":82,"products":83},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":109,"name":110,"problem":111,"products":112},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":148},"acquired-it-systems-become-a-data-breach-vector-for-maersk","Acquired IT Systems Become a Data Breach Vector for Maersk","The Maersk breach highlights a critical risk in mergers and acquisitions: inherited IT systems that have not been fully assessed, hardened, or integrated into corporate security standards can become easy targets. The WhiteArmor ransomware group exploited this gap to steal 100GB of sensitive employee and driver records and demand a $5 million ransom. Acquired systems often carry unknown vulnerabilities, misconfigurations, and inadequate access controls that the acquiring organization may not discover until after an incident occurs. This matters because attackers actively seek out the weakest link in an organization's expanded attack surface, and acquisition targets frequently provide exactly that.",[143,144,145,146,147],"NIS2 Article 21(2)(d)","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships","CIS Control 1: Inventory and Control of Enterprise Assets","NIST SP 800-53 SA-9: External System Services","NIST CSF 2.0 ID.AM-01: Inventories of hardware managed by the organization are maintained",{"NIS2 Article 21(2)(d)":149,"NIST SP 800-53 SA-9: External System Services":150,"CIS Control 1: Inventory and Control of Enterprise Assets":151,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":152,"NIST CSF 2.0 ID.AM-01: Inventories of hardware managed by the organization are maintained":153},"This point specifically requires organizations to manage security risks arising from their supply chain and third-party relationships, directly covering the failure to adequately assess and secure an IT system inherited through an acquisition.","This control requires organizations to assess and monitor the security posture of externally inherited or acquired systems, which would have prompted a security review of the acquired IT environment before it was exploited.","This control requires maintaining an accurate inventory of all assets, including those inherited from acquisitions, so that unknown or unmanaged systems cannot become unmonitored breach vectors.","This control requires organizations to define and implement processes to manage information security risks associated with suppliers and partners, which applies to the security posture of systems brought in through acquisitions.","Maintaining a complete and current asset inventory would have ensured the acquired system was identified, assessed, and brought under Maersk's security management before attackers could exploit it."]