BleepingComputer reports that Danish shipping and logistics group Maersk confirmed a threat actor breached systems belonging to a company it previously acquired and stole data [1]. The WhiteArmor ransomware group listed Maersk on its leak site, demanded $5 million in bitcoin and claims to hold about 100GB of data from the OCF/LF Logistics platform [1]. Maersk says the incident is isolated to a local system, current evidence shows no sensitive data disclosed, and it expects no operational disruption [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
HighMonitoringMedia reported
Shipping giant Maersk admits data taken from an acquired subsidiary's legacy system as WhiteArmor demands $5 million
1 min read
- Disclosed
- Nov 11, 2026
- Published
- Nov 12, 2026
- Last updated
- Nov 13, 2026
- CVSS basis
- Our assessment
- Attack vector
- Impact
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Transportation & logistics
What to do nowOur advice
Maersk says the incident is isolated to a local system, current evidence shows no sensitive data disclosed, and it expects no operational disruption [1]
Timeline
- WhiteArmor lists Maersk on its leak site and demands ransom[1]
- Maersk confirms data theft[1]
- Maersk says incident is isolated to a legacy system from an acquisition, with no sign of impact on other systems or customer integrations[2]
The Record reports Maersk said threat actors gained access to a "legacy system from a previous acquisition", that the incident is isolated to a local system with no indication of impact on other Maersk systems or on customer and partner systems connected via integrations such as APIs and EDI; Maersk said its findings suggest no sensitive data was disclosed and it does not anticipate customer disruption. The statement came three days after the WhiteArmor ransomware gang claimed an attack on LF Logistics, which Maersk acquired in 2022.
Technical details
Remediation
Vendor guidance
- 1Verify unexpected communications mitigate[1]
Treat unexpected messages about the incident with caution and verify via your usual Maersk contact.
References
Media2
- [1]BleepingComputer2026-11-11Accessed 2026-11-11Snapshot 2026-11-12 sha256 0b0d65594991
“Shipping giant Maersk has confirmed that a threat actor breached systems belonging to a company it previously acquired and stole data.”
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.