Maersk confirms data theft from legacy LF Logistics system as WhiteArmor ransomware gang demands $5M for 100GB
Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 12/11/2026 00:01; os links antigos trazem para cá.
Fontes: securityaffairs.com ↗ bleepingcomputer.com ↗ theregister.com ↗
A.P. Moller Maersk is investigating an IT security incident involving unauthorized access to, and suspected data extraction from, a local legacy system inherited through an earlier acquisition (theregister.com, securityaffairs.com). On 11 November 2026 the WhiteArmor ransomware group claimed the theft of about 100GB of data from the OCF/LF Logistics platform and demanded $5 million in Bitcoin, threatening to release the data (bleepingcomputer.com). Maersk says the incident is isolated to a local system, that there is no evidence of impact on its main systems, customers, partners or customer integrations, and that no disclosure of sensitive data is believed to have occurred (theregister.com, bleepingcomputer.com, securityaffairs.com). Operations are reportedly unaffected. The investigation is ongoing, and Maersk is notifying customers as more information becomes available (bleepingcomputer.com). The attacker's claims about the data's contents have not been independently verified.
Detalhes técnicos
- Affected asset: a legacy local system from an acquisition. bleepingcomputer.com identifies the acquired company as LF Logistics. securityaffairs.com says the system is potentially the OCF/LF Logistics platform.
- Claimed volume: about 100GB (bleepingcomputer.com, securityaffairs.com).
- Claimed contents (WhiteArmor's claims):
- About 30,000 driver records.
- Plaintext passwords.
- Highly privileged accounts, specified as 33 super admin accounts (securityaffairs.com).
- Signed delivery receipts.
- Inventory records, purchase orders and advance shipping notices (securityaffairs.com).
- Nearly 28,000 mobile device logs (securityaffairs.com).
- Extortion terms: $5 million in Bitcoin, with a 30-day deadline. WhiteArmor justifies the figure as a small fraction of LF Logistics' earnings (securityaffairs.com).
- No encryption of systems has been reported. The incident is described as data theft and extortion.
- theregister.com notes that the incident echoes the NotPetya attack that hit Maersk, but current disclosures point to a far less damaging impact.
Remediação
No vendor remediation guidance or IOCs have been published. Based on the claimed exposure, defenders linked to LF Logistics or Maersk should consider the following (analyst inference, not from the sources):
- Rotate credentials, especially privileged and admin accounts.
- Review access to the legacy platform.
- Watch for phishing that abuses leaked driver or delivery data.
Affected customers should wait for Maersk's notifications.
Relatos divergentes
- Framing of the incident: theregister.com (first report, 11 November) describes only a suspected data theft from a legacy system and does not mention WhiteArmor or a ransom. bleepingcomputer.com and securityaffairs.com, published later the same day, add the ransomware group's claim and the $5 million demand. The later reports are more complete.
- Affected platform: bleepingcomputer.com states the breach involves the acquired company LF Logistics. securityaffairs.com is more cautious and says the system is potentially the OCF/LF Logistics platform. Maersk has not named the system in the reporting.
- Data claims: the volume and contents come only from WhiteArmor. Maersk says no sensitive data disclosure has been confirmed, so these claims remain unverified.
Linha do tempo
-
WhiteArmor ransomware group claims 100GB data theft from Maersk legacy system, demands $5M ransom
ler a análise desta fonte ocultar
A.P. Moller Maersk confirmed an IT security incident involving unauthorized access and data extraction from a local legacy system inherited from a previous acquisition, potentially the OCF/LF Logistics platform. The ransomware group WhiteArmor has claimed to steal about 100GB of data, including around 30,000 driver records, plaintext passwords, 33 super admin accounts, signed delivery receipts, inventory records, purchase orders, advance shipping notices, and nearly 28,000 mobile device logs. WhiteArmor has publicly demanded $5 million in Bitcoin, giving Maersk 30 days to pay, justifying the ransom as a fraction of LF Logistics' earnings. Maersk states the incident is isolated, with no evidence of impact on other systems, customers, or partners. Their cybersecurity team is investigating, and no sensitive data disclosure has been confirmed yet. This incident highlights risks even to legacy systems of major global logistics operators.
-
Maersk confirms data breach linked to WhiteArmor ransomware extortion demanding $5 million
ler a análise desta fonte ocultar
Shipping giant Maersk confirmed a data breach involving a company it acquired, LF Logistics, with the WhiteArmor ransomware gang claiming to have stolen about 100GB of data from the OCF/LF Logistics platform. The ransomware group publicly demanded a $5 million bitcoin ransom and threatened data release. Maersk stated the breach is isolated to a local system, with no evidence of sensitive data disclosure or broader impact on Maersk's main systems and customer integrations. The investigation is ongoing, and Maersk is notifying customers as more information becomes available. WhiteArmor claims stolen data includes 30,000 driver records, plaintext passwords, highly privileged accounts, delivery receipts, inventory data, and mobile device logs.
-
Maersk Investigates Data Theft Incident in Legacy System
ler a análise desta fonte ocultar
Maersk, the Denmark-based shipping and logistics giant, is investigating an IT security incident suspected to involve data theft from a legacy system acquired through a previous acquisition. The company assures that no sensitive data is believed to have been disclosed and that the incident is isolated to a local system. Maersk maintains that operations are unaffected and emphasizes ongoing cybersecurity efforts. The incident echoes past cyber events, notably the NotPetya attack, but current disclosures suggest a less damaging impact.