[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fU_uxB1NR8f6DJggncAYmWiaMRAsGkXdsIRqledCuvgg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"ed7d2432-d158-4ee8-9bac-b4a1c938039b","legacy-systems-from-acquisitions-become-ransomware-entry-points","dfdc601e-b6e4-4ae4-8dd9-9e510c93d129","Legacy Systems from Acquisitions Become Ransomware Entry Points","Maersk suffered a data breach and $5 million ransomware demand after attackers exploited a legacy system inherited through a corporate acquisition — a system that likely received less security scrutiny than core infrastructure. This highlights a persistent blind spot in M&A security: acquired assets often carry unknown vulnerabilities, outdated configurations, and insufficient monitoring that persist long after the deal closes. The exfiltration of 100GB of data before detection suggests the legacy system lacked adequate logging, network segmentation, or data loss prevention controls. Organizations that fail to integrate acquired systems into their security programs effectively expand their attack surface without expanding their defenses.","**Immediate actions:**\n- Conduct an emergency security assessment of all legacy systems inherited through acquisitions, prioritizing internet-facing or data-rich assets.\n- Isolate or network-segment legacy systems that cannot be immediately patched or upgraded until they are fully assessed.\n- Audit access controls and credentials on all inherited systems to remove stale accounts and enforce least privilege.\n\n**Long-term improvements:**\n- Establish a formal M&A security due diligence process that requires full asset inventory and vulnerability assessment of all acquired technology before integration.\n- Develop a time-bound remediation roadmap for every legacy system ingested through acquisitions, with clear decommission or upgrade deadlines.\n- Apply data classification and DLP controls to legacy environments to detect and block large-scale data exfiltration attempts.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) and network monitoring on all acquired systems as part of the post-acquisition onboarding checklist.\n- Establish alerting thresholds for anomalous data transfers (e.g., bulk file access or large outbound data volumes) across all network segments, including legacy zones.",[12,13,14,15,16],"CIS Control 1: Inventory and Control of Enterprise Assets (v8)","NIS2 Article 21(2)(d)","NIS2 Article 21(2)(e)","NIST SP 800-53 SA-9: External System Services","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships",{"NIS2 Article 21(2)(d)":18,"NIS2 Article 21(2)(e)":19,"NIST SP 800-53 SA-9: External System Services":20,"CIS Control 1: Inventory and Control of Enterprise Assets (v8)":21,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":22},"This point requires security measures addressing supply chain risks, including risks from acquired entities; the legacy system from a prior acquisition was the direct entry point for this attack.","This point covers security in acquisition and maintenance including vulnerability handling; the inherited legacy system's unresolved vulnerabilities were the root cause of the breach.","This control requires organizations to assess and monitor the security posture of externally acquired systems and services, which would have surfaced the risk posed by the legacy acquired system before it was exploited.","This control requires maintaining an accurate inventory of all assets; the breach originated from a legacy acquired system that was evidently not fully tracked or secured within Maersk's asset management program.","This control requires managing information security risks associated with acquired or third-party systems, directly applicable to the failure to adequately secure the system ingested through the prior acquisition.","published","2026-11-11T17:20:40.596408+00:00","2026-11-11T17:20:40.584+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmaersk-confirms-data-breach-as-whitearmor-ransomware-demands-5-million\u002F","maersk-confirms-data-breach-as-whitearmor-ransomware-demands-5-million-9d0e65","Maersk confirms data breach as WhiteArmor ransomware demands $5 million",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":50,"name":51,"problem":52},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",{"slug":54,"name":55,"problem":56},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back."]