Danish integrated shipping and logistics company A.P. Moller-Maersk disclosed Wednesday that it was investigating unauthorized access to and data extraction from a local legacy system inherited through a previous acquisition. The notification follows a weekend claim by the WhiteArmor ransomware group, which says it exfiltrated about 100GB from the Danish shipping and logistics giant’s supply-chain platform and has threatened to publish it.
The company said its investigation was ongoing and that it had secured the affected system. It reported no indication of impact on other Maersk systems or customer and partner systems connected through APIs and electronic data interchange (EDI). It said that it did not anticipate disruption to customer operations. However, the disclosure did not identify initial access vector, threat actor, data extracted or vulnerability involved. It also does not establish whether any OT (operational technology), ICS (industrial control systems) or shipping operations were affected and/or compromised.
“Once the Maersk Cyber Security team discovered the issue, a full investigation was immediately launched and remains ongoing, with swift action being taken to secure the affected system,” the company said in its statement. “Our findings so far strongly suggest no sensitive data has been disclosed. The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI.”
It added, “We do not anticipate disruption to operations for customers at this time, and customers can continue to use Maersk platforms to book and manage their shipments as usual.”
Additionally, “We will keep customers updated as more relevant information becomes available, and if we identify any need to inform impacted parties of any further findings, we will do so,” Maersk said. “Cyber security remains a constant, ongoing priority for Maersk. We have rigorous processes in place to identify and prevent incidents and minimise customer impact.”
Ransomware.live said it discovered the WhiteArmor claim against Maersk on Nov. 7, 2026, at 03:48 UTC, with the attack dated the same day. The victim is listed under Denmark and the transportation sector. The page was last updated on Nov. 10 at 21:50 UTC. According to the tracker, the group says it holds about 100GB of data from the OCF/LF Logistics platform, the contract-logistics arm formerly known as LF Logistics.
The claimed haul includes 29,297 driver records, 16,093 of them with plaintext passwords, and 16,123 staff accounts, 33 of them with super-admin privileges. The group also lists 18,913 delivery recipients with names and addresses, 64,665 signed delivery receipts (214,107 documents in all), 14.44 million inventory rows, 189,248 purchase orders, 334,432 advance shipping notices and 27,842 mobile device logs. Ransomware.live described WhiteArmor as an emerging group and cautioned that the claim should be treated carefully until independently verified.
The group’s post, as reproduced by Ransomware.live, demands $5 million in bitcoin within 30 days. It frames the figure as roughly four hours of Maersk’s EBITDA.
Pulse by Kalir logged the same claim at the same time, Nov. 7, 2026, at 03:48 UTC, and carries identical post text. It notes that a screenshot was published on the leak site and that the group did not cite any press coverage. Its structured record, however, lists the ransom amount and the volume of exfiltrated data as ‘not disclosed,’ which differs from the figures in the group’s own post.
Pulse also recorded one other recent WhiteArmor victim within 48 hours, Colombia’s Clínica La Sagrada Familia. Neither source verifies the group’s claims, and Maersk’s own disclosure points to a legacy system inherited through an acquisition rather than a core platform.
Commenting on the Maersk attack, Seemant Sehgal, founder and CEO at BreachLock, wrote in an emailed statement that acquired systems arrive with their own credentials, their own patch schedule, and connections into the parent network that were set up during integration and rarely revisited. “Ownership of these systems often gets blurred during acquisitions, so any company that grew through acquisitions should know how many of these systems it inherited and what each one can still reach. A penetration test during due diligence answers that before the deal closes, while there is still leverage to fix it.”
“This breach and the way it’s being handled remind me of the Oracle Health breach involving an acquired company’s legacy systems. It’s weird to see companies talk about an acquired system as though that somehow absolves them of responsibility,” John Strand of Black Hills Information Security wrote in an emailed statement. “You bought the company. As soon as the ink is dry, securing those systems is your responsibility. Calling them ‘legacy’ doesn’t change that.
Strand added, “This is why security due diligence needs to be a serious part of mergers and acquisitions. You need to understand what you’re buying, what’s exposed, and what it will take to secure it. If something catastrophic happens, pointing to the previous owner isn’t much of a defense. You can still be left dealing with the legal exposure and the damage to your customers.”
“Unchecked technical debt from corporate acquisitions remains an enterprise blind spot, yet rapid containment can mean the difference between an operational footnote and a multi-million-dollar catastrophe,” Damon Small, board member at Xcape Inc., identified in an emailed statement. “Maersk’s November 11 disclosure of an isolated breach in an inherited legacy system appears relatively benign, especially with core logistics platforms and partner electronic data interchange (EDI) feeds uninterrupted. Still, against the backdrop of escalating critical infrastructure attacks globally, the incident underscores the vital role freight and supply chains play in modern society.”
He added that a decade ago, the devastating 2017 NotPetya campaign cost Maersk an estimated $300 million, but that institutional scar tissue clearly hardened their incident response posture, enabling defenders to isolate the compromised asset before data extortion could threaten vessel movements, cargo flow, or impact customer operations in any significant way. “For executive leadership, the mandate is clear: cyber due diligence during mergers and acquisitions must match the rigorous scrutiny applied to financial audits. When organizations inherit digital infrastructure without auditing obsolete servers, unmonitored databases and applications inevitably turn into prime targets for threat actors seeking an easy corporate foothold.”
