AW Dev Rethought Flash: Maersk Breached Through a System It Inherited in an Acquisition

Maersk disclosed on 11 November that someone gained unauthorised access to one of its IT systems and extracted data.

The system wasn’t part of Maersk’s core platform. In the company’s words, it was a local legacy system “inherited through a previous acquisition.”

A group calling itself WhiteArmor says it has 100 GB of that data and wants $5 million in Bitcoin within 30 days. Maersk says its findings so far “strongly suggest no sensitive data has been disclosed.” Those two accounts don’t fit together, and only one of them has been checked by anyone.

What Maersk Has Confirmed

The confirmed facts are narrow. There was unauthorised access to one legacy system, and data left it. Maersk’s security team investigated and secured the system.

The company says the incident looks isolated. It has found no impact on its wider infrastructure, and none on customer or partner systems connected through APIs and EDI. Customers can keep booking and managing shipments, and no disruption is expected.

Maersk has not said how the attackers got in, when, or how long they stayed. It hasn’t named the system, the acquired business or the attacker. It also hasn’t confirmed any ransom demand.

One line in the advisory deserves attention. Maersk urged customers to verify unexpected communications through their usual contacts. A company only says that when it thinks stolen data could be used for phishing.

What the Attackers Claim

Everything in this section comes from WhiteArmor, and none of it is independently verified.

The group says the data came from the OCF platform built by LF Logistics. Maersk bought LF Logistics from Li & Fung in 2022. It claims 100 GB of logistics records, and it has listed Maersk on its leak site.

The claimed contents are specific:

• About 30,000 driver records
• Passwords stored in plain text
• 33 accounts with top administrative rights
• Signed delivery receipts, purchase orders and shipment notices
• 27,842 mobile device logs with phone numbers, email addresses and IMEI numbers

Ransom groups exaggerate, so treat the list with caution. Specific numbers like these are also easy to check once samples appear, though, which is usually why groups publish them.

“No Sensitive Data” Against That List

Here is the tension. If even part of the claimed list is real, it is hard to call it non-sensitive.

Driver records with phone numbers and device identifiers are personal data. Plain-text passwords are sensitive wherever they come from, because people reuse them. Purchase orders and shipment notices show who ships what to whom, which is commercially valuable and ideal raw material for invoice fraud.

Maersk’s statement and the attackers’ list cannot both be accurate. One of them will be revised.

Maersk did hedge. “Findings so far” and “strongly suggest” are the words of a company that hasn’t finished looking. Initial breach statements often get revised upward, so treat this one as provisional.

The Acquisition You Never Finished

Set the ransom aside and the engineering story is the entry point.

The attackers didn’t go through Maersk’s main platforms. By Maersk’s own account, they went through something the company bought, and the damage stopped there.

Acquired systems are a known weak spot. They arrive with their own authentication, their own patch history and their own undocumented integrations. The integration plan says they’ll be migrated or retired in eighteen months. Then the migration slips, the people who understood the system leave, and it keeps running because something still depends on it.

An acquired system stays inside your perimeter long after anyone is responsible for it.

If the attackers’ attribution is right, this one had been inside Maersk for four years. Plain-text passwords, if that claim holds, would say a lot about how much attention it got in that time.

What To Do Right Now

If you ship with Maersk or integrate with it: take the advisory literally. Verify any unexpected message about shipments, invoices or payment details through a contact you already have. A request to change bank details that quotes a real shipment number deserves suspicion this month.

If you worked with LF Logistics systems: the attackers’ claim is unconfirmed, but changing any password you used there costs nothing. Change it anywhere else you reused it too.

If your company has ever acquired another: ask for the list of inherited systems still running. For each one, ask who owns it, when it was last patched, and how it authenticates. Many companies can’t produce that list quickly, and the systems missing from it are the risk.

Maersk’s investigation is still open. The facts above are the position on 12 November, and the scope may change.