Maersk Confirms Data Theft From a Legacy System It Inherited Through an Acquisition: Why Old Platforms From Bought Companies Are an Open Door

A.P. Moller-Maersk, one of the world's largest container shipping and logistics groups, has confirmed that attackers stole data from one of its systems. The system was not part of Maersk's core network. It was a local platform the company inherited when it bought another business, and that detail is what makes the incident worth studying well beyond shipping.

The confirmation came on Wednesday 11 November 2026, after a group calling itself WhiteArmor listed Maersk on its leak site over the weekend and demanded 5 million US dollars in bitcoin.

What Happened

In its statement, as reported by BleepingComputer, Maersk said a threat actor had gained unauthorised access to a local legacy system inherited through an earlier acquisition and had extracted data from it. The company said the incident was isolated to that local system, that it had found no impact on other Maersk systems or on customer and partner systems connected to it through APIs and EDI, and that current evidence indicated no sensitive data had been disclosed. It does not expect any disruption to operations, and customers can continue to book and manage shipments as normal.

Maersk has not said which system was affected, what kinds of data were taken or when the intrusion happened, and the investigation is ongoing. It has warned customers to be careful with unexpected communications and to check them through their usual Maersk contact.

What the Attackers Claim

WhiteArmor's leak site post, described by BleepingComputer, names the system as the OCF/LF Logistics platform. Maersk acquired LF Logistics, a contract logistics business that had been part of Hong Kong's Li & Fung group, in 2022. The group claims to hold about 100GB of data, including nearly 30,000 driver records, plaintext passwords, 33 accounts with super-administrator rights, signed delivery receipts, purchase order and advance shipping notice records, and 27,842 mobile device logs containing phone numbers, email addresses and IMEI numbers. It has given Maersk 30 days to respond.

None of this has been independently verified, and ransomware groups routinely exaggerate. But if the claims about plaintext passwords and super-administrator accounts are accurate, they point to a platform that had not been brought up to the standard of the rest of the group.

Who Is Affected

On Maersk's account, the direct impact is limited to the inherited platform and the people whose data it held. Based on WhiteArmor's claims, those could include drivers and warehouse staff working with the former LF Logistics business, the users of mobile devices registered to it, and customers and suppliers whose orders and shipping notices passed through it. Maersk has said it will notify customers as it learns more.

The wider risk for anyone in the supply chain is follow-on fraud. Driver records, delivery receipts and shipping notices are exactly the material needed to make fake invoices, delivery diversion requests and phishing messages look genuine.

Maersk knows the cost of a cyber incident better than most. In 2017 the NotPetya attack forced it to rebuild more than 4,000 servers and 45,000 workstations and to run without IT for around ten days, at a cost of up to 300 million US dollars. Its quick statement and its emphasis on isolation this time reflect how much the group has invested since.

Why It Matters

Acquisitions bring in people, customers and revenue. They also bring in IT that was designed, configured and maintained by someone else, to someone else's standards. Integration plans usually focus on the systems that matter to the combined business. The ones that are left running locally because a few sites still need them, or because migration is scheduled for next year, are the ones that drift.

Those systems tend to share the same weaknesses. They sit outside the group's identity platform, so old accounts and shared administrator logins survive. They miss out on central monitoring, so unusual access goes unseen. They run older software that is harder to patch. And because they are described as legacy, no one feels they own them. A system can be isolated from the core network and still hold data that hurts the business, its staff and its customers when it leaks.

The same pattern applies to any organisation that has grown by acquisition, whatever its size and sector.

What To Do Now

List every inherited system that is still running. For each acquisition, record which platforms remain live, what data they hold, who uses them and when they are due to be retired. If no one can answer, that is the first finding.

Bring them under central identity and monitoring. Remove shared and dormant accounts, especially administrator ones, enforce multi-factor authentication and send logs to the same monitoring as the rest of your estate.

Check how passwords and keys are stored. Plaintext or weakly hashed credentials in an old application are a common finding. Fix them or retire the application.

Test them. Include inherited platforms in your penetration testing and vulnerability management scope rather than leaving them out because they are due to be replaced.

Set a retirement date and keep to it. Every month a legacy system runs longer than planned is another month of exposure.

Warn partners about follow-on fraud. If you trade with Maersk or the former LF Logistics business, verify any change to bank details, delivery addresses or contacts through a known channel before acting on it.

How Cybergen Can Help

Cybergen's vulnerability management and CREST penetration testing services help organisations find and test the platforms that sit outside their usual scope, including those that arrive through acquisitions. Our 24/7/365 managed detection and response brings them under the same monitoring as the rest of your estate.

Frequently Asked Questions