Reported by 2 outlets
The story so far
AI summary of the reporting below · Updated · How we work
Danish shipping conglomerate A.P. Moller–Maersk has confirmed that intruders breached systems belonging to an acquired business and stole company data. The disclosure follows claims by the WhiteArmor ransomware gang, which gave Maersk 30 days to pay USD 5,000,000 in bitcoin after listing the company on its leak site. [1][2]
WhiteArmor claims it exfiltrated about 100GB of data from the OCF/LF Logistics platform, including nearly 30,000 driver records, 27,842 mobile device logs, plaintext passwords, and 33 super-administrator credentials. Maersk, which purchased LF Logistics in 2022, said the incident remains isolated to a local system and found no evidence that sensitive data has been disclosed or that connected API and EDI integrations were affected. The carrier added that operations continue without disruption and customers can book shipments as usual. [1][2]
The extortion attempt targets a key player in global shipping that operates 700 container ships across 130 countries. The breach also recalls Maersk's severe 2017 encounter with the NotPetya malware outbreak, an incident that forced the company to rebuild thousands of servers and workstations while sustaining up to $300 million in losses. [2]
Maersk announced that a threat actor gained unauthorized access to a local legacy system inherited through an earlier acquisition and extracted data from it.
via BleepingComputer
The WhiteArmor ransomware group claims it stole 100GB of data from the shipping giant’s systems.
via SecurityWeek