A.P. Moller – Maersk has confirmed that an unauthorized party accessed and extracted data from a legacy IT system the shipping giant inherited through a previous acquisition. The disclosure on November 11, 2026, comes days after a new ransomware gang calling itself WhiteArmor listed Maersk on its data leak site and demanded $5 million.
Maersk has not linked the incident to WhiteArmor or to ransomware, and it has not said which acquired business the affected system came from.
What Maersk has confirmed
In a statement on its website, the Copenhagen-based company said its cyber security team launched a full investigation as soon as it discovered the issue and moved quickly to secure the affected system. The investigation is ongoing.
The company’s key points so far:
- The incident involved unauthorized access and data extraction from “one of our local legacy systems from a previous acquisition.”
- Findings so far “strongly suggest no sensitive data has been disclosed.”
- Maersk found no sign of impact on other Maersk systems or on customer and partner systems that connect through APIs and EDI.
- It does not expect disruption to operations, and customers can keep booking and managing shipments as usual.
Maersk did not say when the intrusion began, how the attacker got in, how much data was taken or what kind of data the system held. It said it will update customers and inform affected parties if its investigation finds a need to do so.
WhiteArmor’s $5 million demand
WhiteArmor added Maersk to its leak site over the weekend before the disclosure. The group reportedly claims to have taken about 100 GB of data from a logistics and supply chain platform, including passwords for more than 16,000 drivers that it alleges were stored in plain text. It is demanding a $5 million payment and threatening to publish the data.
None of these claims have been independently verified. Maersk’s statement does not mention a ransom demand, and the company says its evidence so far points away from sensitive data exposure.
A new gang focused on logistics
WhiteArmor is an emerging extortion group that posted its first victims in late October 2026. In about 3 weeks it has listed roughly 20 organizations, with transportation and logistics firms making up a large share. Its claimed victims include J.B. Hunt, Ryder, Echo Global Logistics, Whirlpool, Hisense and Unilever, and its listed demands range from $140,000 to $20 million.
J.B. Hunt is the clearest case so far. After WhiteArmor claimed the trucking company in late October, a spokesperson acknowledged unauthorized access to certain information in an isolated portion of its technology system, said operations were not disrupted and said law enforcement had been notified. Former employees have since filed proposed class action lawsuits. Most other companies on WhiteArmor’s list have not publicly confirmed an incident.
Old systems, new risks
Systems carried over from acquisitions are a common weak spot. They often run older software, sit outside the parent company’s main security controls and hold data the new owner may not fully map. Maersk’s wording suggests the affected system was isolated from its core network, which would fit its view that customer integrations were not affected.
Maersk has faced major cyber incidents before. The 2017 NotPetya attack shut down large parts of its IT network and cost the company an estimated $250 million to $300 million.
The logistics sector has been a steady target in recent months. In August, a CEVA Logistics cyberattack disrupted European warehouse operations, and the incident later exposed Pokémon Center customer data. In June, a threat actor claimed to be selling 124 million SMSA Express shipment records.
What Maersk customers and drivers should do
- Treat any unexpected message about this incident with caution, as Maersk advises, and verify it through your usual Maersk contact.
- Drivers and partners who used logistics portals tied to Maersk should change those passwords and any reused passwords elsewhere.
- Watch for phishing that uses shipment details, invoices or booking references as a lure.
Maersk had not issued any further public statement on the scope of the stolen data at time of publication. BreachNews will update this story if the company confirms what was taken or whether drivers or customers will be notified.
