[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPbukeq4cVLdA9W6s11iKd5cdZXhka6ZEEcvQOrv5u_U":3},{"article":4,"iocs":49,"watch_terms":53,"solutions":54,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"9e011bbf-6193-49fa-b8fa-823bd25c1b06","WhiteArmor Demands $5 Million from Maersk, Claims Theft of 100GB of Data","whitearmor-demands-5-million-from-maersk-claims-theft-of-100gb-of-data-d15be0","Maersk confirms a data breach involving a legacy system, while WhiteArmor claims 100GB of stolen data and demands a $5 million ransom. A.P. Moller Maersk, the Danish shipping giant, says it identified an IT security incident involving unauthorized access and data extraction from one of its local legacy systems, one inherited from a previous acquisition. […]","Maersk has confirmed an IT security incident involving unauthorized access and data extraction from a legacy system inherited from a previous acquisition. The cybercrime group WhiteArmor claims to have stolen 100GB of data from the OCF\u002FLF Logistics platform and is demanding a $5 million ransom in Bitcoin. WhiteArmor claims the stolen data includes driver records, plain text passwords, and mobile device logs, though Maersk states its findings suggest no sensitive data has been disclosed and the incident is isolated.","WhiteArmor claims to have stolen 100GB of data from Maersk and demands a $5 million ransom.","https:\u002F\u002Fsecurityaffairs.com\u002F202869\u002Fdata-breach\u002Fwhitearmor-demands-5-million-from-maersk-claims-theft-of-100gb-of-data.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2017\u002F08\u002FMaersk.png","2026-11-11T20:47:36+00:00","2026-11-11T22:01:04.678907+00:00",8,[17,20,23],{"name":18,"type":19},"Maersk","vendor",{"name":21,"type":22},"WhiteArmor","threat_actor",{"name":24,"type":25},"OCF\u002FLF Logistics platform","product","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":26,"icon":28,"name":29,"slug":30},null,"Breaches","breaches",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":21,"context":52},"malware","Name of the cybercrime group claiming responsibility for the data theft.",[18,24],{"controls":55,"vendors":142},[56,85,113],{"slug":57,"name":58,"problem":59,"products":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":86,"name":87,"problem":88,"products":89},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":108,"url":111,"description":112},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":114,"name":115,"problem":116,"products":117},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":153},"legacy-system-from-acquisition-becomes-entry-point-for-5m-ransomware-demand","Legacy System from Acquisition Becomes Entry Point for $5M Ransomware Demand","Maersk's incident highlights a critical risk in mergers and acquisitions: inherited IT systems that have not been fully audited, hardened, or decommissioned can become easy targets for attackers. The OCF\u002FLF Logistics platform, acquired through a previous deal, reportedly contained plain text passwords and inadequate access controls — indicators of a system that never met modern security standards. Threat actors like WhiteArmor actively seek out legacy, under-monitored environments precisely because they are likely to have known vulnerabilities and weak defenses. This case underscores that security due diligence must continue long after an acquisition closes, including rapid inventory, risk assessment, and remediation of inherited systems.",[148,149,150,151,152],"CIS Control 1: Inventory and Control of Enterprise Assets (v8)","CIS Control 3: Data Protection (v8)","NIS2 Article 21(2)(d)","NIST SP 800-53 SA-9: External System Services","ISO\u002FIEC 27001:2022 A.8.30: Outsourced development",{"NIS2 Article 21(2)(d)":154,"CIS Control 3: Data Protection (v8)":155,"NIST SP 800-53 SA-9: External System Services":156,"ISO\u002FIEC 27001:2022 A.8.30: Outsourced development":157,"CIS Control 1: Inventory and Control of Enterprise Assets (v8)":158},"NIS2's supply chain security point requires entities to assess and manage security risks introduced by suppliers and acquisitions, which would have prompted earlier security vetting of the inherited logistics platform.","This control prohibits storage of passwords in plain text and mandates data classification, directly addressing the exposed driver records and unencrypted credentials found on the legacy system.","This control requires organizations to assess the security posture of externally acquired or inherited systems and enforce security requirements before integrating them into the enterprise environment.","ISO 27001's controls on acquired and outsourced systems require security requirements to be applied to inherited platforms, which would have mandated credential hygiene and access control reviews on the legacy system.","This control requires maintaining an accurate inventory of all assets, including inherited systems — which would have flagged the legacy OCF\u002FLF Logistics platform for security review and remediation."]