Maersk confirms data theft from legacy system

Hackers claim 100GB taken from a platform Maersk inherited through 2022 acquisition

Maersk has confirmed a data breach connected to a system it inherited via acquisition in 2022. An investigation is ongoing.

Danish shipping giant A.P. Moller-Maersk has confirmed an IT security incident involving unauthorised access to, and data extraction from, a legacy system inherited through a previous acquisition. The Danish shipping and logistics giant disclosed the breach yesterday.

In a customer advisory, Maersk said its cyber security team discovered the issue and immediately launched an investigation, which is ongoing, and that swift action was taken to secure the compromised system.

"Our findings so far strongly suggest no sensitive data has been disclosed," the company said. It added that the incident is isolated to a local system, with no indication of impact on other Maersk systems or on customer and partner systems connected through APIs and EDI.

Maersk does not anticipate disruption for customers, who can continue to book and manage shipments on its platforms as usual. It promised further updates and said it would inform any impacted parties if the investigation reveals more serious compromise.

Customers have also been urged to treat unexpected communications about the incident with caution and to verify them through their usual Maersk contact.

Hacker claims

The disclosure follows claims by a little-known group called WhiteArmor. According to Container News, citing Danish publication Ingeniøren, the group says it holds around 100GB of data from a platform formerly operated by LF Logistics, which Maersk acquired in 2022.

The group claims to have data including 29,297 driver profiles, 16,093 of them with plaintext passwords, plus 16,123 employee accounts, 33 of which are said to have administrative privileges. The group is reportedly threatening to release the data unless it receives approximately $5m in bitcoin by 7 December.

None of this has yet been independently verified, and Maersk has not said WhiteArmor was responsible. Cybernews researchers have linked the breach to LF Logistics, whose platform mostly holds data from other logistics companies, but Maersk has not confirmed a connection. Specialists cited by Ingeniøren suggest the incident looks like data theft and extortion rather than conventional ransomware that encrypts systems.

Echoes of NotPetya

Any mention of Maersk and a cyber incident recalls the 2017 NotPetya attack which the US attributed to the Russian military. The infamous ransomware attack began as an attack on a specific piece of Ukrainian accounting software but rapidly spiralled when someone installed the infected software into a single machine in Maersk.

The ransomware spread laterally throughout Maersk, crippling operations. It soon spread globally and, because it targeted global shipping, the final estimated cost of the damage was thought to be around $10bn.

This incident is unlikely to be as catastrophic, but it does underline the security burden of acquisitions. Legacy platforms that are bolted into larger organisations can be difficult to keep up to date and are therefore an attractive target for attackers, particularly given that they are likely to hold data about third parties.