Maersk Confirms Data Theft from Acquired Logistics System as WhiteArmor Demands $5 Million

The Danish shipping company said its cybersecurity team found the intrusion and began investigating, securing the affected system. Maersk said the system came from an earlier acquisition but did not name the business, while WhiteArmor linked the incident to LF Logistics, a Hong Kong logistics firm Maersk bought in 2022. The extortion group listed Maersk on its leak site on Nov. 7 and gave a 30-day deadline to pay $5 million in bitcoin to prevent publication of data it says it stole.

WhiteArmor's claims, which have not been independently verified, include about 100GB of data from a platform associated with LF Logistics, including roughly 29,000 driver records, of which 16,093 contain plaintext passwords, and 16,123 staff accounts, with 33 listed as superadministrator privileges. The group also claims delivery recipient details, signed delivery receipts, inventory records, purchase orders, shipping notices, and more than 27,000 mobile device logs containing phone numbers, email addresses and IMEI identifiers. Maersk said findings so far strongly suggest no sensitive data was disclosed and the incident was isolated.

The incident shows how acquisitions can leave inherited systems outside a parent company's hardened perimeter, creating gaps in monitoring and credential hygiene. Maersk said it found no indication of impact on other Maersk systems or customer and partner systems connected through APIs and EDI, and does not anticipate disruptions to customer operations. Shipping platforms remain available for booking and managing shipments. The gap between Maersk's limited confirmation and WhiteArmor's detailed leak-site claims remains unresolved: Maersk has not confirmed the group's involvement or said when the intrusion occurred or how access was gained.

Maersk is a central node in global freight, so even a local system tied to logistics operations can expose driver identities, staff credentials, customer delivery details and device metadata. Those data types can support phishing, fraud or operational targeting, particularly where plaintext passwords and superadministrator accounts are involved. WhiteArmor has threatened publication, so the claimed records are already a live exposure even as Maersk investigates and says affected parties will be notified if necessary.