Maersk confirms data was taken from an old logistics system after an extortion group demands $5 million
November 11, 2026 (Claim November 9, Maersk statement November 11, 2026)
A relatively new extortion group, WhiteArmor, listed Maersk on its leak site over the weekend of November 7 to 9. It claims about 100 GB from the OCF/LF Logistics platform, the contract-logistics business Maersk bought in 2022, including driver records with plaintext passwords, staff accounts, delivery receipts, purchase orders and phone logs, and it demands $5 million in bitcoin. On November 11 Maersk said it had found unauthorized access to, and data taken from, a local legacy system inherited through an earlier acquisition. It says the incident is limited to that system, that other systems and customer and partner connections through APIs and EDI show no impact, that it expects no disruption, and that its findings so far strongly suggest no sensitive data was disclosed. Its statement does not name the group or the acquired business, and Maersk has not publicly confirmed that the data WhiteArmor holds comes from this system. Infosecurity Magazine reports that WhiteArmor has also claimed other logistics firms in the past month.
Why it matters
Systems that come with an acquisition are often older and less watched than the buyer's own, and logistics data such as driver logins and order records is useful for fraud and cargo theft.
What defenders can take from it
- After an acquisition, bring inherited systems under the same monitoring, password rules and patching as the rest, or shut them down.
- Never store passwords in plain text.
- Maersk logistics partners and drivers: change passwords used on the platform and be wary of messages that use order or delivery details.