Maersk says attackers broke into a legacy system belonging to a company it previously acquired, and a ransomware group is demanding $5 million to keep the stolen data off the internet.
In its incident report, Maersk did not name the acquired company. It said the incident is isolated to a local system, with no sign of impact on other Maersk systems or on customer and partner systems connected through integrations such as APIs and EDI (the standard data-exchange format used in logistics). "Our findings so far strongly suggest no sensitive data has been disclosed," the company said. Customers can keep booking and managing shipments as usual.
The named target comes from the attackers. A group calling itself WhiteArmor listed Maersk on its leak site and said the victim is the former LF Logistics, a Hong Kong-based logistics firm Maersk bought in 2022 for $3.6 billion. Maersk has not confirmed that link. WhiteArmor gave a 30-day deadline for payment in bitcoin.
The group also claims to hold 100GB, including almost 30,000 driver records, plaintext passwords, 33 SUPER_ADMIN accounts, signed delivery receipts and 27,842 mobile device logs with phone numbers, emails and IMEI numbers. None of that is verified, and Maersk said it is still assessing the claims.
If the claims hold, the exposed credentials would force a broad password reset, and the contact details would suit phishing. A $5 million demand is small next to a company with more than $50 billion in revenue, which suggests the group is betting on embarrassment as much as payment.
The contrast with 2017 is sharp. NotPetya froze Maersk's global network and cost it between $250 million and $300 million. This time the company describes a contained, local problem. Whether the leaked data matches that description is the open question.