Shipping behemoth Maersk confirmed that an older IT system was breached, in what hackers claiming to be the group WhiteArmor say was a theft of 100GB of logistics and supply-chain data. The group published Maersk’s name on its leak site and is demanding $5 million in Bitcoin within 30 days.
The intrusion was disclosed publicly on November 11, 2026. Maersk’s notice states that the compromised system came from a past acquisition — the LF Logistics platform, acquired in 2022 as part of its purchase of Li & Fung’s LF Logistics. That platform services supply-chain operations. A full cyber investigation is underway, and the affected system has been secured, though only limited details have been confirmed. WhiteArmor alleges many kinds of sensitive data were accessed; Maersk has not verified all of those claims yet.
What the Hackers Say They Took
According to WhiteArmor, the haul includes about 30,000 driver records; passwords stored without encryption; 33 accounts carrying top-administrative privileges; signed delivery receipts; purchase orders; shipment notifications; plus nearly 27,842 logs from mobile devices—complete with phone numbers, emails, and IMEI identifiers. While the group claims all that data is in hand, Maersk has not confirmed any of those specifics.
What Maersk Confirms and What Remains Unknown
The company acknowledges that there was unauthorized access and data extraction from this legacy system. However, Maersk says it hasn’t identified exactly which files were accessed, how the attackers entered systems, or when the breach began. Importantly, Maersk asserts it hasn’t seen evidence of systems being encrypted or impacted via ransomware.
Maersk also maintains the breach was confined to one isolated system and didn’t extend to other corporate systems, its partners, or customers through APIs or EDI systems. Operational continuity is expected to remain intact, and customers can still use Maersk’s regular shipping-booking platforms without interruption. Maersk says it will publish updates if the scope changes, and is preparing to notify affected parties as needed.
The company has urged clients to treat any unexpected communication about the incident cautiously, confirming information only via trusted internal channels.
This attack comes amid a rash of recent cybersecurity incidents across shipping and logistics firms. Previous cases include a breach at CEVA Logistics affecting valve customers, and another at ShipMonk that exposed customer data from hardware wallet firm Trezor. These situations illustrate how data held outside primary retail systems—such as third-party shipper databases—can become attack vectors.
At present, confirmed facts are sparse: one legacy system exposed, unauthorized data extraction. The 100GB figure, ransom demand, and detailed list of alleged stolen items are based on hacker claims pending validation. Investigators are working to verify whether sensitive data was truly disclosed.
What This Means & What to Watch
This incident underscores how legacy systems acquired during mergers remain potent risks. Organizations integrating new businesses must treat older platforms with the same scrutiny as core infrastructure—patches, audits, and encryption should be non-negotiable. For Maersk, the next few weeks are crucial: whether WhiteArmor’s claims hold up, how much of the data was genuinely exposed, and whether regulatory or legal fallout follows. It’s a stark reminder that even titans of industry are vulnerable when any piece of their supply-chain tech goes unchecked.
