A.P. Moller – Maersk, the Danish shipping and logistics group, said on Wednesday, November 11, that it identified an IT security incident involving “unauthorised access and data extraction from one of our local legacy systems from a previous acquisition.” In a notice on its website, the company says its findings so far “strongly suggest no sensitive data has been disclosed,” that the incident is isolated to that one system, and that it has found no sign of impact on other Maersk systems or on customer and partner systems connected through integrations such as APIs and EDI. It does not expect disruption to operations, and customers can keep booking and managing shipments as usual.
The notice does not name an attacker. According to BleepingComputer, a ransomware group called WhiteArmor listed Maersk on its leak site over the weekend, demanded $5 million in bitcoin within 30 days, and claimed to hold about 100 GB taken from the OCF/LF Logistics platform. BleepingComputer notes that Maersk bought LF Logistics, the platform’s original developer, from the Li & Fung Group in 2022. The group’s claimed contents, as relayed by BleepingComputer, include nearly 30,000 driver records, plaintext passwords, 33 super-admin accounts, signed delivery receipts, purchase-order and shipping-notice data, and 27,842 mobile device logs with phone numbers, emails and IMEI numbers. None of that is confirmed: Maersk has not shared which system was affected, what kinds of data were taken or when the intrusion happened, and BleepingComputer said it had not heard back from the company when it published.
Maersk says it will update customers as more information becomes available and will tell impacted parties directly if it identifies a need to. Its one piece of advice for now: treat any unexpected communication claiming to relate to the incident with caution and verify it through your usual Maersk contact. BleepingComputer recalls that Maersk was also hit by the NotPetya malware in 2017, which forced it to rebuild thousands of servers and workstations.