Hackers Breach Global Shipping Giant Maersk and Claim Theft of 100GB of Logistics Data

A.P. Moller–Maersk has confirmed that hackers accessed an older IT system and extracted data, as a group calling itself WhiteArmor claims it stole 100GB of logistics records.

The shipping giant disclosed the incident on November 11, 2026, but has not confirmed the attackers’ identity, the claimed data volume, or what was taken.

In its official security notice, Maersk said the affected system came from a previous acquisition. Its cybersecurity team launched an investigation after discovering the breach and took action to secure the system. The investigation remains ongoing.

According to BleepingComputer’s report, WhiteArmor listed Maersk on its leak site and demanded $5 million in bitcoin within 30 days. The group claims the stolen files came from the OCF/LF Logistics platform, which supports logistics and supply chain work. Maersk acquired LF Logistics from Li & Fung in 2022.

The attackers allege that their haul includes nearly 30,000 driver records, passwords stored in plain text, 33 accounts with top administrative rights, and signed delivery receipts.

They also claim to hold purchase orders, shipment notices, and 27,842 mobile device logs containing phone numbers, email addresses, and device identifiers known as IMEI numbers. These details remain claims, not confirmed findings.

Hackers Breach Global Shipping Giant Maersk

Maersk has not publicly linked WhiteArmor or the LF Logistics platform to its investigation. Its statement confirms unauthorized access and data extraction.

However, it does not identify the files taken, explain how the attackers entered, or disclose when the intrusion began. The available evidence also does not establish that ransomware encrypted any systems.

“Our findings so far strongly suggest no sensitive data has been disclosed,” Maersk said. The company described the incident as isolated to a local system and reported no indication of impact on other Maersk systems or connected customer and partner systems. That includes connections through application programming interfaces, or APIs, and electronic data interchange, or EDI.

Customers can continue using Maersk platforms to book and manage shipments. The company does not currently expect operational disruption and says it will provide updates as more information becomes available. It will also notify affected parties if further findings require it.

The case follows other breaches involving shipping providers. Cybersecurity News previously covered the CEVA Logistics breach affecting Valve customers and the ShipMonk breach involving Trezor customer records. Those incidents show how delivery information held outside a retailer’s own systems can become exposed. They do not establish a link to the Maersk incident.

Maersk has urged customers to treat unexpected communications about the breach with caution and verify them through their usual company contact.

For now, the confirmed facts remain limited to access and data extraction from one legacy system. The claimed 100GB theft, ransom demand, and alleged sensitive records require further verification as investigators determine the incident’s full scope.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Hackers Breach Global Shipping Giant Maersk and Claim Theft of 100GB of Logistics Data appeared first on Cyber Security News.