The Danish shipping giant Maersk has announced that one of its technical systems has been subjected to a data extraction incident, coinciding with claims from the WhiteArmor ransomware group that they have seized sensitive information and are demanding $5 million to prevent its publication.
Details of the breach and leaked data
According to WhiteArmor on their dedicated data leak site, the attack targeted a platform associated with LF Logistics (a Hong Kong-based logistics company acquired by Maersk in 2022). The group claims to have obtained approximately 100 GB of data, including:
- Approximately 29,000 driver records, of which 16,093 contain passwords in plaintext.
- 16,123 employee accounts, including 33 accounts with superadministrator privileges.
- More than 27,000 mobile device records including phone numbers, email addresses, and IMEI identifiers.
- Other data including inventory logs, purchase orders, shipping notices, and signed delivery receipts.
Maersk's response and current status
For its part, Maersk clarified in a statement issued on November 11 that the affected system is a legacy system from a previous acquisition, without specifying the name of the acquired company. The company confirmed that its cybersecurity team discovered the breach and initiated investigations to secure the affected system.
The company's initial investigation results indicate no signs of sensitive data leakage so far. It also emphasized that the incident was isolated to a local system and did not extend to other Maersk systems or those of customers and partners connected via APIs or Electronic Data Interchange (EDI). The company also confirmed that its shipping platforms remain available for booking and shipment management without interruption.
Why this news matters
This incident highlights the cybersecurity risks associated with mergers and acquisitions in the global logistics sector. Acquired companies often carry technical vulnerabilities or legacy systems that become entry points for attackers. It also underscores the challenge faced by major corporations in securing complex digital supply chains, where a breach in a subsystem or legacy system can threaten the security of entire operational data, even if the company succeeds in technically isolating the damage and preventing attackers from reaching central systems.