Maersk Confirms Data Theft From an Acquired Company's System as WhiteArmor Ransomware Claims 100 GB From the LF Logistics Platform and Demands Million
Maersk says an attacker stole data from a legacy system of an acquired business, while the WhiteArmor group claims 100 GB including driver records and plaintext passwords and demands million.
A.P. Moller-Maersk, the Danish shipping and logistics giant, has confirmed that an attacker breached a system belonging to a company it previously acquired and took data from it. The confirmation came after a ransomware group calling itself WhiteArmor listed Maersk on its leak site and demanded $5 million in bitcoin. The group claims to hold about 100 GB of data from Maersk's contract-logistics platform.
What Happened
WhiteArmor posted Maersk on its extortion site over the weekend of 7–8 November 2026. The group says it gave the company "30 days to contact" it and pay the ransom in bitcoin. It mockingly described the $5 million demand as "roughly four hours" of Maersk's EBITDA.
Maersk confirmed the incident on 11 November. The company said the intrusion is isolated to "a local system" belonging to a previously acquired business. It said it has found no impact on other Maersk systems, or on customer and partner systems connected to it through APIs and EDI. According to Maersk, current evidence indicates that "no sensitive data has been disclosed". The investigation is ongoing.
Maersk has not said which system was affected, what types of data were taken, or when the intrusion began.
What the Attackers Claim
WhiteArmor says the data comes from the OCF/LF Logistics platform. LF Logistics is the contract-logistics business Maersk bought from Hong Kong's Li & Fung Group in 2022, and it originally developed that platform. The group describes it as Maersk's fulfilment arm for large consumer brands.
The group's claims, which have not been independently verified and which Maersk has not confirmed, include:
- Close to 30,000 driver records
- Plaintext passwords
- 33 "SUPER_ADMIN" accounts
- Signed delivery receipts
- Inventory records with purchase orders and advance shipping notices
- 27,842 mobile device logs containing phone numbers, email addresses and IMEI numbers
Maersk has not publicly linked the incident to LF Logistics. Researchers who analysed the claim concluded the breach relates to that business. Little is publicly known about WhiteArmor as a group.
Is Shipping Disrupted?
No. Maersk says it does not expect operational disruption, and customers can continue booking and managing shipments as usual. That sets this incident clearly apart from 2017. Back then, the NotPetya wiper forced Maersk to rebuild more than 4,000 servers and 45,000 workstations, left it running without IT for about ten days, and cost up to $300 million.
Who Is Affected
If WhiteArmor's description is accurate, the people most directly at risk are:
- Drivers and warehouse staff whose names, contact details and device identifiers may be in the data
- Platform users whose passwords were allegedly stored in plaintext
- Consumer-brand customers of the contract-logistics business, whose purchase orders, shipment notices and delivery receipts could reveal commercial information
Maersk says it will notify customers "as more relevant information becomes available".
What To Do Now
If you are a Maersk or LF Logistics customer or partner:
- Verify unexpected messages. Maersk is urging customers to confirm any unusual communication through their usual Maersk contact. Expect invoice-fraud and "change of bank details" phishing that uses real shipment data.
- Rotate credentials. If your staff had accounts on the contract-logistics platform, rotate those passwords, and any reused elsewhere, given the plaintext-password claim.
- Review integrations. Check API keys and EDI credentials shared with the platform, and monitor for unusual API calls.
- Brief logistics and finance teams on lures that cite genuine purchase order numbers or delivery receipts.
For any organisation that grows by acquisition:
- Inventory inherited applications and identity stores, and bring them under central monitoring and MFA.
- Find and retire legacy platforms that store passwords in plaintext or have large numbers of super-admin accounts.
- Include acquired systems in penetration tests and incident response exercises.
Why It Matters
Inherited systems are a recurring weak point in large enterprises. Acquired platforms often keep their own identity stores, admin accounts and security practices for years after a deal closes, outside the parent company's main controls. The alleged details here fit that pattern: plaintext passwords and dozens of super-admin accounts on a platform originally built by another company.
Even if Maersk's core shipping operations are untouched, logistics data has real value to criminals. Driver identities, device identifiers and live purchase-order details make convincing raw material for fraud and social engineering across the supply chain. The coming weeks will show whether Maersk's "no sensitive data" assessment holds, and whether WhiteArmor follows through on its threat to publish.
