Maersk Confirms Breach as WhiteArmor Demands $5M
Maersk confirms a threat actor breached a system from an acquired company. WhiteArmor claims 100GB stolen and demands $5 million. Maersk reports no operational impact.
Morgan "airgap" ReyesBreach confirmed. Scope unconfirmed. Maersk says a threat actor breached systems belonging to a company it previously acquired and stole data, per BleepingComputer’s November 11 report.
What Maersk says
Maersk states the incident is “isolated to a local system.” It reports no indication of impact on other Maersk systems, or on customer and partner systems connected through APIs and EDI. It does not expect operational disruption, and says customers can keep booking and managing shipments as usual.
The company’s current evidence indicates “no sensitive data has been disclosed.” The investigation is ongoing. Maersk has not said which system was affected, what data types were taken, or when the intrusion occurred. Confidence: low on scope, because the company has disclosed none.
What the attacker claims
Unverified. The WhiteArmor ransomware group listed Maersk on its leak site over the weekend and set a 30-day deadline for a $5 million bitcoin payment. The group says it holds about 100GB taken from the OCF/LF Logistics platform. Maersk acquired LF Logistics, the platform’s original developer, from Li & Fung Group in 2022.
WhiteArmor’s claimed contents, none independently confirmed:
- Nearly 30,000 driver records
- Plaintext passwords
- 33 SUPER_ADMIN accounts
- Signed delivery receipts
- Inventory rows with purchase orders and advance shipping notices
- 27,842 mobile device logs with phone numbers, emails and IMEI numbers
Maersk has not confirmed any of these figures.
Customer guidance
Maersk advises customers to treat unexpected communications about the matter with caution and to verify them through their usual Maersk contact. It says it will notify customers as more information becomes available.
Context
Maersk was hit by NotPetya in 2017. The company rebuilt more than 4,000 servers and 45,000 workstations, ran without IT for ten days, and reported damages of up to $300 million, according to BleepingComputer. Nothing reported so far ties this incident to that scale of disruption.
Analysis: the affected platform came through an acquisition and sits outside Maersk’s core systems, which is consistent with the company’s isolation claim. That is an inference, not a finding. Maersk has not described the system’s architecture.
More on this topic at the ransomware hub. Status will be updated if Maersk or WhiteArmor release further detail.
Found this useful? Share it.
