[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcOI69QaIAK4nvUi6Aygw6BEU1YyY0LXE5n5Iy0TtQwE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"6d63e60b-efd4-4de7-ab36-25b6b1f78b6e","maersk-ransomware-hit-stems-from-unretired-legacy-system-inherited-in-acquisition","2d159c7a-841b-4f79-9025-9ecc46484cb3","Maersk Ransomware Hit Stems from Unretired Legacy System Inherited in Acquisition","When Maersk acquired LF Logistics in 2022, it also inherited its legacy IT infrastructure — and the security debt that came with it. The WhiteArmor ransomware gang exploited this legacy system, allegedly exfiltrating 100GB of data, illustrating how M&A activity can silently expand an organization's attack surface. Legacy systems acquired through mergers are frequently under-patched, poorly documented, and inadequately integrated into the acquiring company's security controls. This incident underscores that security due diligence cannot end at the deal closing — inherited systems must be rapidly assessed, hardened, or decommissioned to prevent them from becoming a weak link in an otherwise mature security posture.","**Immediate actions:**\n- Isolate all legacy systems inherited from acquisitions behind strict network segmentation until they can be fully assessed and hardened.\n- Conduct an emergency vulnerability scan of all LF Logistics–originated systems and prioritize remediation or decommissioning of end-of-life assets.\n- Revoke or rotate any shared credentials and access tokens associated with the compromised legacy environment.\n\n**Long-term improvements:**\n- Establish a formal M&A security integration playbook that mandates a full asset inventory, vulnerability assessment, and risk rating within 90 days of any acquisition closing.\n- Define and enforce a maximum permitted age policy for legacy systems, with a clear decommissioning timeline tied to risk thresholds.\n- Ensure acquired subsidiaries are brought under the parent company's patch management and vulnerability tracking programs within a defined onboarding window.\n\n**Detection measures:**\n- Deploy file-integrity monitoring and anomaly-based detection on legacy systems to flag unusual data access or exfiltration patterns early.\n- Integrate legacy acquired systems into centralized SIEM logging so that suspicious activity does not go undetected in a siloed environment.\n- Subscribe to threat intelligence feeds relevant to the shipping and logistics sector to receive early warning of ransomware campaigns targeting the industry.",[12,13,14,15,16],"NIS2 Article 21(2)(d)","CIS Control 1: Inventory and Control of Enterprise Assets (v8)","NIST SP 800-53 SA-9: External System Services","NIST CSF 2.0 ID.AM-1: Asset Management","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships",{"NIS2 Article 21(2)(d)":18,"NIST CSF 2.0 ID.AM-1: Asset Management":19,"NIST SP 800-53 SA-9: External System Services":20,"CIS Control 1: Inventory and Control of Enterprise Assets (v8)":21,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":22},"This point requires organizations to manage cybersecurity risks arising from their supply chain and third-party relationships, which directly applies to the security risks Maersk inherited by acquiring LF Logistics and its legacy infrastructure.","This category calls for maintaining an inventory of physical and software assets, ensuring that legacy systems brought in through an acquisition are identified, categorized by risk, and subject to appropriate controls before they can be exploited.","SA-9 requires organizations to assess and manage the security of systems and services acquired externally, which would have flagged the unmitigated risk of the inherited LF Logistics legacy environment.","CIS Control 1 requires organizations to actively discover and maintain an inventory of all assets, including those inherited through acquisitions — a gap that left the LF Logistics legacy system inadequately tracked and protected.","This control requires that security risks associated with supplier and acquisition relationships be identified and managed, directly applicable to the inherited security weaknesses from the LF Logistics purchase.","published","2026-11-12T19:20:58.848609+00:00","2026-11-12T19:20:58.818+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Ftherecord.media\u002Fshipping-giant-maersk-says-recent-incident-affected-legacy-system","shipping-giant-maersk-says-recent-cyber-incident-affected-legacy-system-82b94a","Shipping giant Maersk says recent cyber incident affected legacy system",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":50,"name":51,"problem":52},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":54,"name":55,"problem":56},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back."]