Maersk confirms breach of inherited legacy system as WhiteArmor demands $5 million

Maersk verified on Nov. 11, 2026 that an unauthorized entity removed information from an older local system obtained through an earlier corporate buyout.

The company says the incident stays inside one local system, with no sign of impact on other Maersk systems or on partner connections using APIs and EDI (electronic data interchange). Maersk says its early evidence shows no sensitive data disclosure, and it expects no disruption to operations, telling customers they can keep booking and managing shipments on its platforms as normal. “We do not anticipate disruption to operations for customers at this time,” Maersk said. Maersk said its probe remains active and that it has not disclosed when the breach occurred, what data categories the incident involved, or which system the incident affected.

Over the weekend, WhiteArmor put Maersk on its data leak site and said it held about 100 GB of data from a logistics and supply-chain platform. WhiteArmor, the ransomware cartel, demanded USD 5,000,000 in bitcoin and set a 30-day deadline for Maersk to make contact and pay, around Dec. 7, 2026. “You have 30 days to contact us and pay USD 5,000,000 in bitcoin,” the cartel said.

Maersk says the incident is not connected to WhiteArmor or ransomware and that it has not confirmed any ransom demand. The tracker ransomware.live describes WhiteArmor as new and advises caution, noting that none of the group’s data figures has been independently verified. Public sources show no evidence of encryption or data transfer from Maersk infrastructure, and no independent confirmation links the specific data allegedly held by WhiteArmor to the information Maersk acknowledges an unauthorized entity removed.

WhiteArmor claims the alleged files include 27,842 logs from mobile devices with email addresses, phone numbers, and IMEI hardware identifiers. The cartel also claims 29,297 driver records, with 16,093 of those records storing passwords in plain text, along with 16,123 staff accounts, among them 33 accounts with top administrator privileges. The claims also include 18,913 delivery recipients with names and street addresses, 14.44 million inventory rows from warehouses, 334,432 advance shipping notices, 214,107 total documents, 189,248 purchase orders and 64,665 signed delivery receipts.

In 2022, Maersk bought LF Logistics, the creator of the OCF/LF Logistics software, from the Li & Fung Group. LF Logistics, based in Hong Kong, provides fulfillment and warehousing services for major consumer brands. Maersk described the affected system as “one of our local legacy systems from a previous acquisition.”

A.P. Moller–Maersk is a Danish transport and shipping enterprise active across 130 nations. It employs 100,000 workers, and its operations cover land, air, warehouse, port terminal and ocean freight, with 700 container ships accounting for roughly 13.5 percent of global fleet capacity and 60 terminals across 35 countries. Its network of ports, vessels and freight services reaches businesses around the world. Maersk’s financial reports from the previous year showed $54 billion in revenue and a net profit of $2.9 billion, while pre-deduction earnings surged 75 percent to $4.7 billion in the most recent quarterly figures.

The cartel has been active since Oct. 21, 2026, claiming attacks against more than 20 organizations worldwide, including major logistics companies. A putative class action lawsuit followed an alleged attack by the cartel against Arkansas freight shipper J.B. Hunt. NotPetya ransomware struck Maersk in 2017, forcing the company to rebuild over 4,000 servers and 45,000 workstations from scratch, go without IT for ten days, and absorb up to $300 million in damages.

WhiteArmor said by e-mail on Wednesday that Maersk had not reached out to negotiate. No evidence indicates Maersk has paid the ransom. In its public message, the cartel threatened to publish the files unless Maersk paid $5 million in bitcoin within 30 days, and it said the $5 million demand equals about four hours of LF Logistics’ EBITDA (earnings before interest, taxes, depreciation and amortization). “Five million dollars is roughly four hours of that EBITDA.”

The company tells customers to treat unexpected communications claiming to relate to the incident with caution and to verify them through usual Maersk contacts. Maersk said updates from its continuing probes will prompt more alerts to potentially affected individuals if new discoveries require them.

Companies that have acquired businesses should audit inherited systems, accounts and password storage before linking them to their own estate. Such systems often run outdated software, sit beyond the parent company’s main security controls and hold information the new owner may not fully chart; an attacker who reaches one can probe what else those connections can access.