Shipping giant Maersk has confirmed that hackers extracted data from one of its IT systems, while an extortion group claims to have stolen sensitive information and is demanding $5 million.
In a November 11 statement, the Danish company said the affected system was inherited through an earlier acquisition. Maersk has not identified the acquired business.
The company said its cybersecurity team discovered the intrusion and launched an investigation, with action being taken to secure the affected system.
“Our findings so far strongly suggest no sensitive data has been disclosed,” Maersk said.
“The incident is isolated to a local system,” the company added, saying it had found no indication of an impact on other Maersk systems or on customer and partner systems connected through APIs and EDI.
Maersk does not anticipate disruptions to customer operations and says its shipping platforms remain available for booking and managing shipments.
The disclosure follows a claim by the WhiteArmor ransomware group, which listed Maersk on its leak site on November 7 and threatened to publish stolen information unless a $5 million ransom is paid.
WhiteArmor claims to have obtained approximately 100GB of data from a platform associated with LF Logistics, a Hong Kong-based logistics company acquired by Maersk in 2022.
The alleged haul includes roughly 29,000 driver records, of which 16,093 contain plaintext passwords, and 16,123 staff accounts, including 33 with superadministrator privileges.
The hackers also claim to possess information on delivery recipients, signed delivery receipts, inventory records, purchase orders, and shipping notices.
Additionally, WhiteArmor claims to have stolen over 27,000 mobile device logs containing phone numbers, email addresses and IMEI identifiers.
“You have 30 days to contact us and pay USD 5,000,000 in bitcoin,” the hackers said in their extortion message.
The group’s claims have not been independently verified, and Maersk has not confirmed WhiteArmor’s involvement or identified the types of data stolen.
The company has also not disclosed when the intrusion occurred or how the attackers gained access. Its investigation remains ongoing, and affected parties will be notified if necessary.
Related: Revolve Puts Data Breach Victim Count at 1.5 Million
Related: Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers
