WhiteArmor Demands $5 Million from Maersk, Claims Theft of 100GB of Data
WhiteArmor Demands $5 Million from Maersk, Claims Theft of 100GB of Data
Maersk confirms a data breach involving a legacy system, while WhiteArmor claims 100GB of stolen data and demands a $5 million ransom. A.P. Moller Maersk, the Danish shipping giant, states it identified an IT security incident involving unauthorized access and data extraction from one of its local legacy systems, inherited from a previous acquisition.
“Maersk has identified an IT security incident involving unauthorized access and data extraction from one of our local legacy systems from a previous acquisition,” reads the statement published by Maersk on November 11. Our findings so far strongly suggest no sensitive data has been disclosed. The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI.
However, the cybercrime group WhiteArmor added the company to its Tor data leak site. WhiteArmor demanded a $5 million ransom in Bitcoin, giving Maersk 30 days to pay. The group claims to have stolen about 100 GB of data from the OCF/LF Logistics platform, which supports logistics and supply chain operations. Maersk acquired LF Logistics, the company that developed the platform, from the Li & Fung Group in 2022. This could match Maersk’s reference to an old system inherited through an acquisition, although the company has not confirmed this connection.
According to the attackers, the stolen data includes:
- Nearly 30,000 driver records
- Passwords stored in plain text
- 33 super admin accounts
- Signed delivery receipts
- Inventory records
- Purchase orders
- Advance shipping notices
- 27,842 mobile device logs containing phone numbers, email addresses, and IMEI numbers.
These details come from the attackers and have not been independently verified. Maersk’s statement does not confirm their claims. WhiteArmor also tried to justify its demand, saying the $5 million ransom represents roughly four hours of revenue for the logistics business.
The scale of Maersk’s operations explains why this incident matters. A.P. Moller-Maersk is one of the world’s largest integrated shipping and logistics companies, playing a major role in global trade and supply chains. It operates around 700 container ships, representing approximately 13.5% of global container fleet capacity, and manages 60 terminals across 35 countries. In 2017, NotPetya forced the company to reinstall more than 4,000 servers and 45,000 workstations from scratch. It operated without IT for ten days and took damages of up to $300 million.