Maersk Confirms Breach of an Inherited Legacy System as WhiteArmor Demands $5 Million

A.P. Moller-Maersk, the Danish carrier that operates roughly 13.5 percent of global container fleet capacity, confirmed on November 11, 2026 that an attacker broke into a legacy IT system and took data. The system was not built by Maersk. It came with a company Maersk bought.

Days earlier, a ransomware and extortion group calling itself WhiteArmor had posted Maersk to its leak site with a demand for $5 million in bitcoin and a 30-day deadline. Maersk's notice and the group's claim describe the same kind of system, but Maersk's statement does not name WhiteArmor, and nearly every detail about what was taken comes from the attacker.

What Maersk has confirmed

Maersk's customer notice is short and careful. According to reporting by BleepingComputer and SecureWorld, the company states that:

• An attacker gained unauthorized access to a local legacy IT system inherited through a previous acquisition, and extracted data from it.
• "The incident is isolated to a local system." Maersk reports no impact on its other systems, or on customer and partner systems connected through APIs and EDI.
• The investigation is ongoing, and current evidence indicates that "no sensitive data has been disclosed."
• No operational disruption is expected. Customers can keep booking and managing shipments.
• Customers should verify any unexpected communication about the incident through their usual Maersk contacts, and Maersk will notify customers "as more relevant information becomes available."

Maersk has not named the affected system, said what kind of data left it, said how much, or said when the intrusion happened or how the attacker got in.

What WhiteArmor claims

WhiteArmor listed Maersk on its data leak site over the weekend of November 7 and 8. The group says the data comes from the OCF/LF Logistics platform, the supply chain and fulfilment system of the former LF Logistics, and that it holds about 100 GB. Its inventory, as reported by BleepingComputer:

• Nearly 30,000 driver records
• Plaintext passwords
• 33 SUPER_ADMIN accounts, the most privileged account type on the platform
• Signed delivery receipts
• Inventory rows with purchase orders and Advance Shipping Notices
• 27,842 mobile device logs with phone numbers, email addresses and IMEI numbers

The demand reads: "You have 30 days to contact us and pay USD 5,000,000 in bitcoin." The group also did the math for its target in public, writing that "Five million dollars is roughly four hours of that EBITDA." If the clock started with the listing, the deadline falls in the second week of December.

The system: a $3.6 billion acquisition, four years on

LF Logistics was a Hong Kong contract logistics company. Maersk bought it from Li & Fung in 2022 for $3.6 billion, a deal that added 223 warehouses and about 10,000 employees across Asia-Pacific, along with the technology that ran them. That business is now Maersk's contract logistics arm, and WhiteArmor points out that it runs fulfilment for large consumer brands.

The platform WhiteArmor names was developed by LF, not by Maersk. Four years after closing, it was still running as its own local system. That is not unusual. Warehouse and fulfilment platforms are wired into scanners, handhelds, carrier feeds and customer integrations, and replacing them is slow and expensive. They tend to keep their own credential stores, their own patch cycles and their own admin accounts long after the logo on the building changes.

This is not 2017

Maersk is the company most associated with the cost of a cyberattack. In June 2017, NotPetya forced it to rebuild about 4,000 servers and 45,000 workstations and to run without IT for roughly ten days, at a cost of up to $300 million.

This incident looks nothing like that. Ships are sailing, terminals are working and bookings are open. Damon Small, a board member at Xcape, told SecureWorld that "The $300 million lesson from 2017 paid off," and that "This time, the legacy server took the hit while the ships kept moving." Maersk has not described its network architecture, so segmentation as the reason is an informed reading and not a confirmed fact. The outcome so far is consistent with it.

Inherited systems are still your systems

Containment is the good news. The harder question is why a platform that may have held plaintext passwords and dozens of top-privilege accounts was reachable at all. John Strand of Black Hills Information Security put it plainly to SecureWorld: "You bought the company. As soon as the ink is dry, securing those systems is your responsibility."

Maersk is not the first to learn this in public. Oracle acquired Cerner in 2022, and an attacker later used compromised customer credentials to reach legacy Cerner servers that had never been migrated. A Texas Attorney General filing in October put the number of people affected near 20 million. Same year of acquisition, same class of system, same gap.

Darin Fredde of Ridge Security summed up the timeline problem: "An acquisition may close financially in a few months. The security obligations can last decades." The open questions he raises are the ones Maersk has not answered: what was accessed, how the attacker got in, and whether the boundary around the legacy environment held.

SecureWorld's coverage closes on four practices for security teams: keep a current inventory of every system inherited through acquisition, map what each one can still reach, review integration-era credentials and connections on a schedule, and set firm decommissioning dates for legacy platforms.

RedEye assessment

Three things stand out.

The extortion is data-only. Nothing in either account describes encryption or downtime. WhiteArmor's leverage is publication, which means the people with the most to lose are not Maersk's shareholders. They are the drivers whose records and device identifiers may be in the set, and the brands whose purchase orders and shipping notices describe their supply chains.

The follow-on risk is phishing. Maersk's own advice to verify unexpected communications is the tell. Signed delivery receipts, purchase orders and shipping notices are exactly the raw material for convincing invoice fraud and delivery-themed lures aimed at Maersk's customers and carriers, whether or not the ransom is paid.

The gap between the two accounts is a logging question. Maersk can say with confidence that its core network and partner connections were untouched. It has not yet said what left the legacy system, how much, or when. That pattern is typical of inherited platforms: the core estate is instrumented and watched, while the acquired system writes logs locally, if at all, and nobody is reading them. When 100 GB allegedly leaves a server and the first detailed inventory of the loss comes from the attacker, the acquirer is negotiating blind.

From the warehouse to the hull: where Caver Maritime fits

This breach landed in a warehouse platform, not on a ship. For a maritime operator that distinction is thinner than it sounds. In our review of this summer's port, tanker and LNG carrier incidents, the pattern was the same each time: the business network is the way in, and the systems that move cargo sit one hop behind it. An inherited logistics platform with its own admin accounts and its own vendor connections is exactly that kind of business-side door. Maersk appears to have kept this one shut off from the rest of the house. Most fleets and terminals have never tested whether theirs is.

Caver is RedEye's security analytics platform, and its maritime edition is built to watch that whole path, from the shore office to the engine room. We laid it out layer by layer in our ship defense breakdown after the VL Prosperity intrusion. Read against the Maersk incident, these are the pieces that matter.

On shore: the inherited system and every path out of it

• Every session on record. NetFlow, IPFIX, sFlow and Suricata EVE land in one lake, so each connection in or out of a legacy platform is evidence the operator keeps. "How much left, and on which days" becomes a query, not a question for the attacker's leak site.
• Vendor and remote-access inventory. One screen for every vendor and remote-access path into the environment, including the integration-era connections nobody has reviewed since the deal closed.
• Remote sessions flagged as they open. RDP or VNC arriving from outside, remote-support tools starting a session, a session from somewhere a vendor has never connected from, and a session followed by a new service or a privilege change. A new top-privilege account on a forgotten server is the kind of event this is built to surface.
• Zone and conduit map. The segmentation drawn as zones and the conduits between them, so a path from an acquired business system toward terminal or vessel systems is visible before someone uses it. That is the picture behind a statement like "isolated to a local system."

At the terminal and aboard: the systems the business network leads to

• The satellite terminal, watched. Caver Maritime ships detections for the ship's VSAT terminal: its management page reached over cleartext HTTP, telnet or FTP sessions to it, and scripted user-enumeration probing of its web interface.
• Passive decoding of the control network. The Caver collector decodes Modbus TCP, DNP3, EtherNet/IP and CIP, S7comm, OPC UA and other industrial protocols from a passive tap. Every read, write and device on the machinery or cargo-handling network becomes a record, and nothing is ever sent to a controller.
• The IT-to-OT path, scored. Detection coverage is mapped against MITRE ATT&CK for ICS, including the rules whose techniques cross from the enterprise side into the control side. That crossing is the step that turns a data theft into a ship or crane that stops.
• What is around and aboard the hull. AIS decoded into vessel identity, a census of every emitter aboard with anything first heard since the last port flagged, and separate detections for GNSS jamming and spoofing.
• Sealed, and built to live aboard. Caver runs on the vessel or at the terminal. In sealed mode it refuses every outbound connection outside an explicit allowlist, so the security platform never becomes one more inherited system talking to the internet.

For shore and the regulator: one fleet, one record

• Fleet and shore SOC board. Every vessel on one screen, with sensor count, last port call and how stale each ship's stream is. Shore knows which ship has gone quiet before the master calls.
• Evidence keyed to the Coast Guard rule. Caver ships a USCG MTS report template keyed to the CFR section numbers of 33 CFR part 101 subpart F, plus IEC 62443 grading with the query behind every grade. Cyber incidents at covered U.S. vessels and facilities have been reportable to the National Response Center since July 16, 2025, and a report is only as good as the record behind it.
• Detections that keep arriving. RedEye's detection feed delivers rules over STIX and TAXII, or as a signed offline bundle for a sealed install, so the watch on a legacy system does not age the way the system does.

The same foundation is what CISA lays out in its Logging Reference Architecture, which we map to Caver at getcaver.com/cisa-logging. A legacy warehouse platform, a container terminal and a ship's engine room have the same problem: the system nobody wants to touch is the one that most needs a record of who touched it. Maersk's ships kept moving this time. The operators worth worrying about are the ones who could not say why theirs would.

Sources

• BleepingComputer: Maersk confirms data breach as WhiteArmor ransomware demands $5 million (November 11, 2026)
• SecureWorld: Maersk Breach Puts Spotlight on Inherited M&A Risk (November 12, 2026)
• TechRadar: Shipping giant Maersk confirms data breach as hackers demand $5 million ransom