Global shipping giant A.P. Moller–Maersk has confirmed a cybersecurity breach involving unauthorised access and data extraction from a legacy system, following claims by a hacker group that it stole approximately 100GB of sensitive information linked to the company’s logistics operations.
In a statement issued on Wednesday, the Danish shipping group disclosed that an unauthorised party had accessed a local system inherited through a previous acquisition. Maersk said its cybersecurity team immediately launched an investigation and took steps to secure the affected system.
The disclosure followed claims by a relatively unknown hacking group, WhiteArmor, which alleged that it had obtained a substantial volume of operational and personal data from a logistics platform formerly operated by LF Logistics, acquired by Maersk in 2022.
According to Danish technology publication Ingeniøren, the hackers claim the alleged haul includes 29,297 driver profiles, with 16,093 reportedly containing passwords stored in plaintext, as well as 16,123 employee accounts, including 33 with elevated administrative privileges.
The alleged stolen information also comprises details of nearly 19,000 delivery recipients, more than 64,000 signed delivery receipts, approximately 14.44 million warehouse inventory records and hundreds of thousands of purchase orders and shipment notifications.
WhiteArmor has reportedly demanded around US$5 million in bitcoin, threatening to release the information if payment is not made by 7 December.
However, neither the authenticity nor the full extent of the alleged data theft has been independently established. Maersk has also not confirmed that WhiteArmor was responsible for the breach.
Seeking to reassure customers and business partners, Maersk said its preliminary findings strongly suggest that no sensitive information had been disclosed, although it acknowledged that data was extracted from the affected system.
“Our findings so far strongly suggest no sensitive data has been disclosed,” the company said.
Maersk further stated that the incident appeared confined to the local legacy system, with no indication that its wider corporate infrastructure or customer and partner platforms connected through application programming interfaces (APIs) and electronic data interchange (EDI) had been compromised.
The company does not anticipate disruption to customer operations, adding that its digital platforms remain available for booking and managing shipments.
It said investigations were continuing and that potentially affected parties would be notified if subsequent findings warranted further communication.
The incident has renewed concerns over cybersecurity risks associated with legacy technology, particularly systems inherited during corporate acquisitions and subsequently integrated into larger business operations.
Cybersecurity specialists cited by Ingeniøren reportedly consider the hackers’ claims credible, although the available evidence points more towards data theft and extortion than a conventional ransomware attack involving the encryption of systems.
Crucially, however, no independent evidence has yet established that the data allegedly held by WhiteArmor is the same information Maersk confirmed was extracted.
Maersk has urged customers to exercise caution over unexpected communications referencing the incident and to verify suspicious messages through established company contacts.
With the investigation ongoing, questions remain over the volume and nature of the information accessed, the potential exposure of individuals and business partners, and whether the alleged ransom threat will result in the publication of stolen data.
