Danish shipping company Maersk confirmed on 11 November, in a notice published on its website, that an attacker had extracted data from a local system inherited from an acquired company. The WhiteArmor group, which says it hit the platform of former LF Logistics, is demanding $5 million in bitcoin. Maersk says the incident is contained and has no impact on its operations, but the case highlights an often underestimated risk: IT systems taken on during an acquisition.
What Maersk acknowledges
According to BleepingComputer, Maersk confirmed that a malicious actor had broken into the systems of a company it had acquired and extracted data from them. The investigation is ongoing. At this stage, according to the company, no sensitive data has been disclosed, and the incident is limited to a local system, with no repercussions on its other systems or on those of customers and partners connected via API or EDI, the electronic exchange of business documents.
The group says it expects no disruption: customers can continue to book and track their shipments. Maersk has specified neither the date of the intrusion nor the nature of the data involved, and promises to keep its customers informed as things progress.
According to WhiteArmor, the targeted system is the OCF/LF Logistics platform, which it links to the group’s contract logistics arm. Maersk bought LF Logistics in 2022 from the Li & Fung group, which originally designed it.
What WhiteArmor claims
Danish outlet Ingeniøren detailed on 10 November the claims published by the group on its leak site. WhiteArmor says it stole around 100 GB of data, including:
- 29,297 driver profiles, 16,093 of them with a password stored in plain text;
- 16,123 employee accounts, including 33 super-administrator accounts;
- the names and addresses of 18,913 delivery recipients and 64,665 signed proofs of delivery;
- 14.44 million rows of warehouse inventory, 189,248 purchase orders and 334,432 shipping notices;
- 27,842 mobile device logs containing phone numbers, email addresses and IMEI identifiers.
These figures have not been independently verified: Ingeniøren was unable to authenticate a screenshot showing accounts and passwords. The group is demanding around $5 million in bitcoin, which it says is the equivalent of four hours of Maersk’s profit, and threatens to publish the data otherwise. The countdown displayed on its site expires on 7 December.
Data theft rather than ransomware
WhiteArmor is a recent and little-known group. Ingeniøren reports that it openly seeks to recruit insiders at large companies in exchange for payment, and that it also claims thefts at Unilever and Hisense. Asked by the outlet, Thomas Wilkans, head of threat research and intelligence at Lab-1, considers the claim credible. He sees it as probably a simple exfiltration rather than a ransomware attack, as Maersk’s systems do not appear to have been encrypted. Nothing suggests, in his view, that an employee was complicit.
The contrast with 2017 is stark. That year, BleepingComputer recalls, the NotPetya attack forced Maersk to rebuild more than 4,000 servers and 45,000 workstations, at an estimated cost of up to $300 million.
What this means for businesses
For partners and delivery recipients, the immediate risk is targeted phishing. Names, addresses and phone numbers linked to real deliveries make it possible to write credible messages. Maersk recommends treating any unexpected communication on the subject with caution and checking it with your usual contact. Drivers whose password may have been stored in plain text would do well to change it wherever they have reused it.
For any company that grows through acquisitions, the lesson is broader. An acquired platform often keeps running with its own practices, such as the plain-text password storage claimed here by the attacker, even though it now carries the acquirer’s name and reputation. Inventorying these legacy systems, aligning them with the group’s security policy or retiring them is part of integration, just like accounting.
Frequently asked questions
Are Maersk customers affected by this breach?
According to Maersk, the incident is limited to a local system inherited from an acquisition, which WhiteArmor presents as the LF Logistics platform, with no impact on the systems of customers connected via API or EDI. The investigation is, however, ongoing and the company promises to inform them if necessary.
Who is WhiteArmor?
A recent extortion group that publishes its victims on a leak site, also claims Unilever and Hisense and seeks to buy access from employees of large companies, according to Ingeniøren.
What should you do if you receive a message mentioning this case?
Do not click or reply directly, and check the request with your usual contact at Maersk, as the company recommends.
Sources
- Maersk confirms data breach as WhiteArmor ransomware demands $5 million — BleepingComputer, 2026-11-11
- IT security incident — Maersk (official notice), 2026-11-11
- Mærsk ramt af datalæk: Hackere hævder at have adgang til kundedata — Ingeniøren, 2026-11-10