Maersk investigates cyberattack on acquired unit as extortionists demand $5 million in bitcoin

Danish shipping giant A.P. Moller–Maersk confirmed it is investigating an IT security incident after hackers breached a legacy system tied to an acquired company. Ransomware group WhiteArmor listed Maersk on its leak site, claiming to have stolen approximately 100GB of data and demanding USD 5,000,000 in bitcoin within 30 days. [1][2][3][4]

WhiteArmor alleges the stolen files originate from the OCF/LF Logistics platform and include plaintext passwords, 33 SUPER_ADMIN accounts, nearly 30,000 driver records, and 27,842 mobile device logs containing phone numbers and IMEI numbers. Maersk acquired Hong Kong-based LF Logistics in 2022. The company says the intrusion remains isolated to a local system, with no signs of impact on broader networks or partner integrations via APIs and EDI, and that current findings strongly suggest no sensitive data has been disclosed. [1][3][4]

Maersk stated that core shipping operations continue as normal and customers can book and manage cargo without disruption. The breach revives memories of the 2017 NotPetya cyberattack, which paralyzed Maersk's global operations, wiped thousands of servers and computers, and cost the company up to $300 million. [1][3][4]