Maersk Confirms Data Was Taken From a Legacy System It Inherited in an Acquisition. WhiteArmor Says It Has 100 GB and Wants $5 Million. Here Is What Each Side Has Actually Said
If you work with Maersk as a shipper, carrier or driver, treat any unexpected message about this incident as a possible phishing attempt and check it through your usual Maersk contact, which is Maersk's own advice. If your company has bought another company in the last few years, find every system that came with it and ask who patches it, who watches its logs and whether it still has its own passwords. That inherited system is what Maersk says was breached.
What Maersk confirmed
Maersk's advisory of November 11, 2026, titled "IT security incident," is the primary source. In its words, Maersk "has identified an IT security incident involving unauthorised access and data extraction from one of our local legacy systems from a previous acquisition." It says:
- An investigation is ongoing and the affected system was secured.
- "Our findings so far strongly suggest no sensitive data has been disclosed."
- "The incident is isolated to a local system," with no indication of impact on other Maersk systems or on customer and partner systems connected through APIs and EDI.
- It does not expect disruption, and customers can keep booking and managing shipments as usual.
- "Please treat any unexpected communications claiming to relate to this matter with caution and verify them through your usual Maersk contact."
So two things are confirmed by the victim: someone got in without authorization, and data was taken out. Maersk does not name the system, the acquisition, the attacker, the date of the intrusion or the kind of data. It does not mention a ransom or encryption.
What WhiteArmor claims, and who reported it
Everything in this section is the attacker's claim, relayed by BleepingComputer (Bill Toulas, November 11, 2026). We did not view the leak site. None of it is confirmed by Maersk.
- WhiteArmor listed Maersk on its data leak site over the weekend before Maersk's statement and demands 5 million US dollars in bitcoin, with 30 days to pay.
- It claims about 100 GB taken from what it calls Maersk's OCF/LF Logistics platform. BleepingComputer notes that Maersk bought LF Logistics from Li and Fung in 2022 and that LF Logistics built that platform. That fits Maersk's "previous acquisition," but Maersk has not named it.
- The claimed contents: nearly 30,000 driver records, passwords stored in plain text, 33 accounts with top-level administrator rights, signed delivery receipts, inventory rows with purchase orders and shipping notices, and 27,842 mobile device log entries with phone numbers, email addresses and device IMEI numbers. The 30,000 and 27,842 are the gang's counts of records in its own copy; nobody independent has counted them.
- Maersk's "no sensitive data" and the gang's "plain-text passwords" cannot both be right in full. Which one is closer is not known yet.
WhiteArmor is not in our threat-actor index of 366 profiles, and we found no prior record of it in our corpus. The press calls it a ransomware group, but no source we read says anything was encrypted. What is described is theft and a demand to pay.
The lesson: an acquisition hands you systems you did not build
The breach Maersk describes is not in its core shipping platforms. It is in a "local legacy system" that came with a company it bought. That pattern repeats because acquired systems tend to fall between two owners: the acquired team has moved on or been merged, and the parent's security team may not know the system exists, or knows it but has it on a migration list rather than a patch list. Separate password stores, older software and accounts nobody reviews are typical. If the gang's claim of plain-text passwords and 33 top-level administrator accounts is accurate, it describes exactly that kind of system.
What to do
- If you are a Maersk customer, partner or driver: treat unexpected messages about this incident, including requests to reset passwords or change payment details, as suspect and confirm them through your normal Maersk contact. If you ever used an LF Logistics or Maersk contract-logistics login, and you reused that password anywhere else, change it there.
- If you have made acquisitions: list every system that came with each acquired company, including ones scheduled for retirement. For each, name one owner in your own security team.
- Bring those systems under your normal controls now, not after migration: central login with multi-factor, your logging and alerting, your patch cycle. A system waiting to be retired is still reachable until it is switched off.
- Check how each inherited system stores passwords. Plain text or weak hashing means every account in it should be treated as exposed if it is ever breached, so fix it before that.
- Review administrator accounts on inherited systems and remove any that nobody can name an owner for.
What is not known
When the intrusion happened, how the attacker got in, what exactly was taken, whether the leaked data is real (the gang has not been verified to publish it), and whether WhiteArmor encrypted anything. Whether Maersk will notify drivers or other individuals; it says it will inform affected parties if its findings require it.
How we know, and how we checked
We read Maersk's advisory on maersk.com directly and BleepingComputer's report. We did not view WhiteArmor's leak site or any stolen data, and would not. We searched our own threat-actor, indicator and research indexes for WhiteArmor and found no profile and no indicators. No source we read published any IP addresses, domains or file hashes, so we add nothing to our feed for this incident.
Sources
A.P. Moller - Maersk, "IT security incident," advisory, November 11, 2026 (maersk.com/news/articles/2026/11/11/it-security-incident). BleepingComputer, "Maersk confirms data breach as WhiteArmor ransomware demands $5 million," Bill Toulas, November 11, 2026.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.