Maritime shipping and logistics giant Maersk confirmed that a malicious actor gained unauthorized access to an older local system inherited through a previous acquisition and extracted data from it. This announcement comes at a time when a ransomware gang known as WhiteArmor claimed responsibility for the attacks, threatening to publish approximately 100 gigabytes of leaked information.
Details of the Breach and Affected System
The company clarified that investigations into the incident are still ongoing, confirming that current evidence indicates no sensitive or confidential data was exposed, and that operational operations are continuing normally without any expected disruptions for customers, who can continue to book and manage their shipments via the company's usual systems. Maersk pointed out that the breach remained confined to a purely local system, with no impact detected on other systems or on the networks of customers and partners connected via Application Programming Interfaces (APIs) or Electronic Data Interchange (EDI).
Ransomware Gang Demands and Data Volume
For its part, the WhiteArmor gang listed Maersk on its data leak site, demanding a financial ransom of 5 million dollars within a maximum period of 30 days, payable in Bitcoin. The group claims to hold approximately 100 gigabytes of data leaked from the logistics and contracts platform belonging to LF Logistics, which Maersk acquired in 2022. The alleged data includes records of about 30,000 drivers, plain-text passwords, SUPER_ADMIN privilege accounts, signed delivery receipts, as well as mobile device logs containing phone numbers, email addresses, and International Mobile Equipment Identity (IMEI) numbers.
What This Event Represents for the Company's Cybersecurity Future
This incident recalls the massive cyberattack that Maersk faced in 2017 by the NotPetya malware, which at the time forced it to rebuild a complete infrastructure comprising over 4,000 servers and 45,000 workstations from scratch, causing massive losses. Although the company asserts this time that the damage is confined and limited to an older local system, the incident highlights the risks associated with acquisitions and the integration of legacy technical systems that may leave vulnerabilities that hackers can exploit to extort major corporations.