Maersk confirms data breach as hackers claim 100 GB logistics haul

A.P. Moller–Maersk has confirmed that an unauthorised party extracted data from a legacy IT system inherited through an acquisition, after a hacker group claimed to have stolen roughly 100 gigabytes of information tied to the carrier's logistics operations.

In a statement issued on 11 November, the Danish group acknowledged unauthorised access to a local system dating from a previous acquisition. Maersk said its cybersecurity team immediately opened an investigation and secured the affected platform. The company did not name the intruder.

What do the hackers claim to hold?

The claims come from WhiteArmor, a relatively unknown group that says it breached a platform previously operated by LF Logistics, the Hong Kong-rooted contract logistics business Maersk bought in 2022 and folded into its warehousing and distribution operations.

According to Danish technology publication Ingeniøren, the alleged dataset is granular and operationally sensitive:

• 29,297 driver profiles, of which 16,093 reportedly contain plaintext passwords
• 16,123 employee accounts, including 33 with elevated administrative privileges
• Information on nearly 19,000 delivery recipients
• More than 64,000 signed delivery receipts
• Roughly 14.44 million warehouse inventory records
• Hundreds of thousands of purchase orders and shipment notifications

If accurate, the plaintext passwords and administrative accounts alone would represent a serious credential exposure across Maersk's warehousing network. WhiteArmor has demanded approximately US$5 million in bitcoin, threatening to publish the data unless paid by 7 December.

Those are claims, not established facts. Maersk has not publicly attributed the incident to WhiteArmor, and no independent verification has confirmed the scale of the theft or linked the group's alleged dataset to the data Maersk acknowledges was extracted.

How has Maersk responded?

The carrier's public position is that the damage is contained. "Our findings so far strongly suggest no sensitive data has been disclosed," Maersk stated, despite confirming that data left the affected system.

That sentence carries weight, and a caveat. "So far" covers a preliminary investigation into an incident whose full extent Maersk itself says is not yet established. The company adds that the incident appears isolated to the local legacy system, with no indication that other Maersk systems or customer and partner platforms connected through APIs and electronic data interchange (EDI) were affected. Digital platforms remain available for booking and managing shipments, and Maersk does not anticipate disruption to customer operations.

Maersk has committed to informing potentially affected parties if further findings make additional notifications necessary. It has also advised customers to treat unexpected communications referencing the incident with caution and to verify suspicious messages through established company contacts — a standard warning against phishing that, in this case, follows a genuine breach.

Why does a legacy system matter to shippers?

The incident spotlights a structural risk in logistics: acquired platforms that keep running inside larger organisations long after the deal closes. LF Logistics became part of Maersk's integrator strategy in 2022, and the compromised system was, by Maersk's own description, a local legacy platform carried over from that acquisition.

Cybersecurity specialists cited by Ingeniøren assess WhiteArmor's allegations as credible in character, while noting the pattern points to data theft and extortion rather than a conventional ransomware attack encrypting systems. That distinction matters commercially — no encryption means no operational outage — but extortion attacks can still leak customer, driver and consignee data if demands are not met.

For shippers and forwarders using Maersk's warehousing and distribution services, the immediate operational picture is unchanged: bookings, EDI links and APIs remain live. The unresolved question is data, not uptime. With a 7 December payment deadline set by a group whose haul is unverified, and an investigation that Maersk says remains ongoing, the next credible signal will come from either independent confirmation of the dataset or Maersk's own further notifications.