Ransomware · 11h ago
On Nov. 11, Maersk confirmed unauthorized access and data extraction from a local legacy system inherited through an acquisition, after WhiteArmor claimed it stole 100GB and demanded $5 million. Maersk says its findings so far strongly suggest no sensitive data was disclosed and that the incident is isolated, with no indication of impact on other systems or customer integrations. Its shipping platforms remain available.
WhiteArmor’s unverified claim lists driver records, 16,093 plaintext passwords, 16,123 staff accounts—including 33 with superadministrator privileges—and mobile-device logs. Maersk has not confirmed the data types taken, WhiteArmor’s involvement, or how access occurred. If the claimed credentials are real, exposure could enable identity misuse even without disruption to shipping systems.
For companies that retain local systems from acquired businesses, isolation from core platforms does not settle what data or credentials left the inherited environment. If those credentials are used elsewhere, the exposure could persist beyond the system Maersk says it secured.
7 sources covering this story
The Record from Recorded Future
Shipping giant Maersk says recent cyber incident affected legacy system
The incident is the latest in a string of attacks on ports and other shipping organizations worldwide, with Brazil’s largest port hit with ransomware last week.
WhiteArmor gang claims responsibility for latest cyber attack on shipping giant Maersk
Shipping giant Maersk has confirmed that one of its systems was broken into by hackers who have stolen data.
Maersk investigates legacy-system breach after WhiteArmor ransomware group claims theft of 100GB of logistics data.
Maersk Reveals Data Breach as Extortion Group Demands $5m
Maersk has revealed a threat actor extracted data from one of its legacy systems
Maersk Confirms Data Theft Amid $5 Million Extortion Attempt
The WhiteArmor ransomware group claims it stole 100GB of data from the shipping giant’s systems.
Maersk confirms data breach as WhiteArmor ransomware demands $5 million
Maersk announced that a threat actor gained unauthorized access to a local legacy system inherited through an earlier acquisition and extracted data from it.
Shipping giant Maersk probes 'IT security incident,' data theft
Says it 'strongly' suspects attack limited to legacy system, and that nothing sensitive is at risk
Part of the PlainSec briefing for 2026-11-13