Maersk breach shows secondhand ships carry cyber doors nobody locks

A ransomware group called WhiteArmor claims to hold roughly 100 GB of data from a platform linked to LF Logistics — the business Maersk bought for $3.6bn in 2022 — and wants $5m for it. On November 11, Maersk confirmed that attackers had entered a local legacy system "inherited through a previous acquisition" and taken data from it. The company says the breach stayed confined to that system and never touched customer or partner connections. It hasn't named the business, and none of the gang's claims are verified.

The facts will settle in time. The lesson won't wait, and it isn't really about Maersk. A system that arrives with an acquisition brings its own passwords, its own remote connections and its own suppliers — while the people who understood all that leave with the seller. If WhiteArmor's claim is right, that door stood open for four years.

Here's the uncomfortable part for shipping. The industry does exactly this every week, with ships.

What actually changes hands in a sale?

A secondhand bulker comes with its class certificates, its trading record and the documents listed in the memorandum of agreement. It also arrives with things no saleform lists:

• The administrator accounts on bridge and engine-room computers
• The engine maker's remote-service link
• The satellite terminal and its user accounts
• The planned-maintenance software, plus whoever still holds a login to it
• The crew network set up by the previous manager's IT contractor

The buyer's superintendent checks the hull, the machinery and the paperwork. Few delivery protocols carry a line saying all passwords changed, all of the seller's remote access removed, all standing vendor connections listed. Nobody signs for that. Everyone assumes it.

The same drift happens without a sale. A change of technical manager moves the ship onto new systems and new people, while the old manager's accounts often stay on board until someone stumbles across them.

What does the regulation say?

Plenty, as it turns out. Since 2021, cyber risk has had to be addressed in every company's safety management system under the ISM Code. Ships contracted from July 2024 must meet the IACS unified requirements E26 and E27 on cyber resilience — but the secondhand tonnage changing hands today was mostly built before that cutoff.

In the EU, NIS2 pulls shipping companies above a size threshold into its scope. An early warning is due within 24 hours of a significant incident; a fuller notification within 72.

That's where inheritance gets expensive. An owner who discovers an intrusion through a system nobody knew existed must explain, against those deadlines, what the system was, who had access, and why it was still connected. "It came with the ship" is an explanation. It is not evidence of control.

What does this change for buyers?

Less than it should, unless buyers put it in writing. The fix costs little and fits into work owners already do. Three steps cover most of it.

First, put it in the inspection. A cyber section in the pre-purchase inspection that lists the networked systems on board, their makers and who holds remote access takes a few hours — and gives the buyer leverage while the price is still open.

Second, put it in the delivery protocol. At handover, every administrator password gets changed, every remote account of the seller and its contractors gets closed, and every connection that stays — the engine maker's, the ECDIS supplier's — is confirmed in writing with the buyer named as the new owner.

Third, write it down with a date. A short record signed at delivery of what was found, what was changed and what was kept. If something goes wrong a year later, that record is the difference between showing the door was locked and hoping it was.

How much room does Maersk have?

Plenty, historically. It got through NotPetya in 2017, which cost it up to $300m — roughly the price of a modern feeder newbuilding programme, absorbed and survived. An owner with ten ships, half of them bought secondhand, has rather less margin for a nine-figure hit.

The arithmetic is blunt. The cheapest moment to find out what came with a ship is the day it changes hands — and the secondhand market shows no sign of slowing down to wait for buyers to notice.