Maersk confirms data theft from legacy LF Logistics system as WhiteArmor ransomware gang demands $5M for 100GB
Matéria consolidada. Reúne 8 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 7 fontes trouxeram em 12/11/2026 12:02; os links antigos trazem para cá.
Fontes: industrialcyber.co ↗ infosecurity-magazine.com ↗ securityweek.com ↗ gbhackers.com ↗ securityaffairs.com ↗ bleepingcomputer.com ↗ theregister.com ↗
A.P. Moller Maersk is investigating an IT security incident involving unauthorized access to, and suspected data extraction from, a local legacy system inherited through an earlier acquisition (theregister.com, securityaffairs.com, industrialcyber.co). On 11 November 2026 the WhiteArmor ransomware group claimed the theft of about 100GB of data from the OCF/LF Logistics platform and demanded $5 million in Bitcoin, threatening to release the data (bleepingcomputer.com). On 12 November securityweek.com described the acquired company as the Hong Kong-based LF Logistics and said Maersk's cybersecurity team detected the intrusion and contained it to a local system. Maersk says the incident is isolated, that there is no evidence of impact on its main systems, customers, partners or customer integrations, and that no disclosure of sensitive data is believed to have occurred (theregister.com, bleepingcomputer.com, securityaffairs.com, infosecurity-magazine.com). Operations are reportedly unaffected. The investigation is ongoing, and Maersk is notifying customers as more information becomes available (bleepingcomputer.com). The attacker's claims about the data's contents have not been independently verified, and the initial access vector, exploited vulnerabilities and any operational technology impact remain undisclosed (industrialcyber.co).
Detalhes técnicos
- Affected asset: a legacy local system from an acquisition. bleepingcomputer.com and securityweek.com identify the acquired company as LF Logistics (securityweek.com: Hong Kong-based). securityaffairs.com says the system is potentially the OCF/LF Logistics platform. The affected system has been secured (industrialcyber.co).
- Claimed volume: about 100GB (bleepingcomputer.com, securityaffairs.com, securityweek.com, infosecurity-magazine.com).
- Claimed contents (WhiteArmor's claims):
- About 30,000 driver records.
- Plaintext passwords.
- Highly privileged accounts, specified as 33 super admin accounts (securityaffairs.com); securityweek.com refers to staff accounts with superadmin privileges.
- Signed delivery receipts.
- Inventory records, purchase orders and advance shipping notices (securityaffairs.com).
- Nearly 28,000 mobile device logs (securityaffairs.com, infosecurity-magazine.com).
- Extortion terms: $5 million in Bitcoin, with a 30-day deadline. WhiteArmor justifies the figure as a small fraction of LF Logistics' earnings (securityaffairs.com).
- Actor: infosecurity-magazine.com describes WhiteArmor as a recent extortion group active against logistics firms.
- No encryption of systems has been reported. The incident is described as data theft and extortion.
- Context: theregister.com notes that the incident echoes the NotPetya attack that hit Maersk, but current disclosures point to a far less damaging impact. infosecurity-magazine.com notes Maersk has not faced a major cybersecurity event since the 2017 NotPetya attack.
- Analyst commentary: experts quoted by infosecurity-magazine.com stress that legacy systems carry risk during mergers and acquisitions because of ownership confusion and rarely revisited integrations. They emphasize pen testing, asset awareness and continuous security validation. industrialcyber.co likewise points to security due diligence and integration challenges.
Remediação
No IOCs have been published. Maersk advises caution regarding potential phishing attempts referencing the incident (gbhackers.com). Based on the claimed exposure, defenders linked to LF Logistics or Maersk should also consider the following (analyst inference, not from the sources):
- Rotate credentials, especially privileged and admin accounts.
- Review access to the legacy platform.
- Watch for phishing that abuses leaked driver or delivery data.
For acquirers in general, experts recommend inventorying inherited assets and running pen tests and continuous security validation on legacy systems (infosecurity-magazine.com). Affected customers should wait for Maersk's notifications.
Relatos divergentes
- Ransom demand: gbhackers.com (12 November) says no ransom demand or ransomware activity has been reported. bleepingcomputer.com, securityaffairs.com, securityweek.com, infosecurity-magazine.com and industrialcyber.co report the WhiteArmor claim and the $5 million demand. The demand is WhiteArmor's own claim and is not confirmed by Maersk. The gbhackers.com statement appears to reflect Maersk's disclosure only, and the multiple later reports are more complete.
- Framing of the incident: theregister.com (first report, 11 November) describes only a suspected data theft from a legacy system and does not mention WhiteArmor or a ransom. bleepingcomputer.com and securityaffairs.com, published later the same day, add the ransomware group's claim and the $5 million demand.
- Affected platform: bleepingcomputer.com and securityweek.com (more recent) state the breach involves the acquired company LF Logistics. securityaffairs.com is more cautious and says the system is potentially the OCF/LF Logistics platform. Maersk has not itself named the system in the reporting.
- Data claims: the volume and contents come only from WhiteArmor. Maersk says no sensitive data disclosure has been confirmed, and gbhackers.com notes the nature of the system and the data extracted are still under investigation, so these claims remain unverified.
Linha do tempo
-
Maersk investigates breach of legacy system after WhiteArmor claims theft of 100GB logistics data
ler a análise desta fonte ocultar
Danish shipping giant A.P. Moller-Maersk is investigating unauthorized access and data exfiltration from a local legacy system inherited via acquisition, following a claim by the WhiteArmor ransomware group of stealing approximately 100GB of logistics data. The affected system has been secured and the breach appears isolated, with no impact currently reported on Maersk's core systems or partner integrations. Sensitive data exposure is still being assessed. The incident underscores risks in legacy systems acquired through mergers, highlighting challenges in security due diligence and integration. WhiteArmor demands $5 million in ransom for the stolen data. Further details such as initial access vector, exploited vulnerabilities, or impact on operational technology remain undisclosed.
-
Maersk suffers data breach of legacy system; extortion group WhiteArmor demands $5 million
ler a análise desta fonte ocultar
Maersk has disclosed a data breach in one of its local legacy IT systems inherited from a previous acquisition, following claims by the extortion group WhiteArmor that it stole 100GB of logistics-related data. The company states the breach is isolated, with no evidence of sensitive data exposure or impact on core Maersk systems or connected customer platforms. WhiteArmor, a recent extortion group active against logistics firms, demands $5 million in Bitcoin and claims to possess driver records, plaintext passwords, staff accounts, and mobile device logs. Experts highlight the risks legacy systems pose during mergers and acquisitions due to ownership confusion and rarely revisited integrations, emphasizing the need for pen testing, asset awareness, and continuous security validation. Maersk has not faced a major cybersecurity event since the 2017 NotPetya attack.
-
Maersk Confirms Data Theft from Acquired Logistics Platform Amid $5 Million Extortion Demand
ler a análise desta fonte ocultar
Shipping giant Maersk has confirmed a data breach involving an IT system inherited from a previous acquisition, later identified as the Hong Kong-based company LF Logistics. The incident reportedly involves the theft of approximately 100GB of data, including driver records with plaintext passwords, staff accounts with superadmin privileges, and other sensitive operational data. The extortion group WhiteArmor has claimed responsibility, demanding a $5 million ransom in bitcoin and threatening to leak the stolen information. Maersk's cybersecurity team detected the intrusion and has contained it to a local system; they assert no impact on other systems or customer operations and have not yet verified the scope of data disclosure. The investigation remains ongoing, with notifications to affected parties promised if necessary.
-
Maersk Confirms Data Breach Involving Unauthorized Access to Legacy IT System with Data Extraction
ler a análise desta fonte ocultar
A.P. Moller–Maersk has disclosed a data breach resulting from unauthorized access to a local legacy IT system inherited from a previous acquisition. While investigators currently believe no sensitive data was disclosed, the exact nature of the affected system, types of data extracted, and intrusion details remain under investigation. The breach appears isolated with no impact found on other company systems or customer environments. No ransom demand or ransomware activity has been reported, distinguishing this incident from prior attacks such as the 2017 Petya compromise. Maersk continues to provide normal services and advises caution regarding potential phishing attempts referencing the incident. The investigation is ongoing to determine full impact and scope.
-
WhiteArmor ransomware group claims 100GB data theft from Maersk legacy system, demands $5M ransom
ler a análise desta fonte ocultar
A.P. Moller Maersk confirmed an IT security incident involving unauthorized access and data extraction from a local legacy system inherited from a previous acquisition, potentially the OCF/LF Logistics platform. The ransomware group WhiteArmor has claimed to steal about 100GB of data, including around 30,000 driver records, plaintext passwords, 33 super admin accounts, signed delivery receipts, inventory records, purchase orders, advance shipping notices, and nearly 28,000 mobile device logs. WhiteArmor has publicly demanded $5 million in Bitcoin, giving Maersk 30 days to pay, justifying the ransom as a fraction of LF Logistics' earnings. Maersk states the incident is isolated, with no evidence of impact on other systems, customers, or partners. Their cybersecurity team is investigating, and no sensitive data disclosure has been confirmed yet. This incident highlights risks even to legacy systems of major global logistics operators.
-
Maersk confirms data breach linked to WhiteArmor ransomware extortion demanding $5 million
ler a análise desta fonte ocultar
Shipping giant Maersk confirmed a data breach involving a company it acquired, LF Logistics, with the WhiteArmor ransomware gang claiming to have stolen about 100GB of data from the OCF/LF Logistics platform. The ransomware group publicly demanded a $5 million bitcoin ransom and threatened data release. Maersk stated the breach is isolated to a local system, with no evidence of sensitive data disclosure or broader impact on Maersk's main systems and customer integrations. The investigation is ongoing, and Maersk is notifying customers as more information becomes available. WhiteArmor claims stolen data includes 30,000 driver records, plaintext passwords, highly privileged accounts, delivery receipts, inventory data, and mobile device logs.
-
Maersk Investigates Data Theft Incident in Legacy System
ler a análise desta fonte ocultar
Maersk, the Denmark-based shipping and logistics giant, is investigating an IT security incident suspected to involve data theft from a legacy system acquired through a previous acquisition. The company assures that no sensitive data is believed to have been disclosed and that the incident is isolated to a local system. Maersk maintains that operations are unaffected and emphasizes ongoing cybersecurity efforts. The incident echoes past cyber events, notably the NotPetya attack, but current disclosures suggest a less damaging impact.