Maersk Confirms Fresh Cyber Breach in Legacy System

AP Moller-Maersk confirmed a fresh cybersecurity breach on Wednesday: hackers accessed an older IT system and extracted data, nearly a decade after NotPetya caused the carrier an estimated $250 million to $300 million in damage.

The Copenhagen-based Danish ocean container group said the incident involved a local legacy system inherited through a previous acquisition. In June 2017, NotPetya malware crippled Maersk’s IT infrastructure and disrupted container shipping and terminal operations worldwide; the latest disclosure has so far produced no announced equivalent interruption.

Maersk’s cybersecurity team launched an investigation after detecting the intrusion and has taken steps to secure the affected system. “Our findings so far strongly suggest no sensitive data has been disclosed,” the company said. The wording remains preliminary and narrower than saying no data was taken: Maersk has already confirmed that data was extracted.

The carrier said the breach appeared confined to that legacy system. It reported no indication that other Maersk systems, or customer and partner systems connected through application programming interfaces and electronic data interchange, had been compromised. Maersk does not expect customer-operations disruption, and its digital booking and shipment-management platforms continued to operate normally.

Has Maersk's container operation been disrupted?

On Maersk’s account, shippers and freight forwarders face continuity of bookings and shipment administration, not an announced halt to cargo movement. The announcement does not identify delayed sailings, canceled port calls, terminal slowdowns, rerouted containers or additional charges. Nor does it provide an affected booking count, TEU, tonnage, trade lane, $/FEU rate, vessel-capacity percentage or port-level volume.

That absence limits what carriers, forwarders and cargo owners can model. Maersk disclosed no estimate of remediation cost, downtime, insurance recovery or customer-claim exposure tied to the new incident. Nothing in the statement supports a forecast of higher ocean freight rates or reduced vessel capacity, because the confirmed impact concerns data access rather than announced physical disruption.

For Maersk itself, the company has not put a financial estimate on this incident. The immediate burden is investigation and system security, while customer assurance remains tied to Maersk’s preliminary finding. That assessment could change if the investigation identifies wider system access or data exposure.

What does the WhiteArmor claim establish?\n

Separately, a hacker group calling itself WhiteArmor claimed it obtained around 100 GB of logistics data from a platform associated with LF Logistics, the Hong Kong-based logistics business Maersk acquired for $3.6 billion in 2022. The group reportedly demanded $5 million in bitcoin.

Those claims remain unverified, and Maersk has not confirmed any connection between the alleged theft and the incident under investigation. It also has not said it made a payment.

The 100 GB figure measures an asserted volume, not the value, sensitivity or commercial use of the data. The $5 million demand states the alleged group’s price, not a confirmed loss at Maersk. Maersk has not named the acquired business involved, specified the data extracted or identified those responsible.

That leaves the separate claims without a confirmed evidentiary link to the breach Maersk is investigating. The distinction matters for LF Logistics customers and Maersk’s ocean partners: Maersk reports no compromise of customer or partner systems connected through APIs and EDI, but it has not published a forensic scope statement. A later finding that more data or systems were affected could alter that assessment.

How significant is the NotPetya precedent?

The June 2017 attack remains the benchmark. Maersk put its financial damage from the malware attack at $250 million to $300 million, making the event one of the costliest cyber incidents in shipping history. Its effects reached container shipping and terminal operations worldwide after the malware crippled the company’s IT infrastructure.

The contrast with the current incident is operational, not yet conclusive. Maersk has announced normal booking and shipment platforms, no expected customer disruption and no indicated compromise beyond one local legacy system. That differs materially from a worldwide systems outage, although the absence of a quantified impact leaves no basis for declaring the new breach harmless or assigning it a financial cost.

What remains unresolved?

Three gaps matter:

• The identity of the acquired business involved.
• The categories, sensitivity and commercial use of the extracted data.
• Whether WhiteArmor holds information connected to the system Maersk confirmed.

Maersk’s cyber team has not published a completion date for its investigation, and the announcement gives no figure for the number or type of records affected.

For now, no disclosed evidence warrants changing container-rate, capacity or sailing forecasts for shippers, carriers or forwarders. The trajectory will turn on whether normal booking, API/EDI connectivity and terminal operations remain intact as Maersk identifies the system and data, or whether a broader interruption or confirmed extortion link emerges.