Skip to content
NewA calmer, faster ZeroHour
StoryRansomwarehigh

Maersk confirms legacy-system breach as WhiteArmor demands $5 million

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Maersk says one acquired legacy system was breached and data extracted; WhiteArmor's $5 million claim remains unverified.

A.P. Moller-Maersk said on November 11 that unauthorized access and data extraction occurred on one local legacy system inherited from a previous acquisition. It says the incident appears isolated, current evidence shows no sensitive data disclosed, and it expects no shipment disruption or impact on other systems, APIs, EDI links, or connected customer and partner systems. WhiteArmor listed Maersk and demanded $5 million in bitcoin within 30 days, claiming about 100GB from the OCF/LF Logistics platform, including nearly 30,000 driver records, plaintext passwords, 33 super-admin accounts, and 27,842 device logs. Those claims are unverified. Maersk has not named the system or intrusion date; Security Affairs reports it has not linked the incident to LF Logistics, acquired from Li & Fung in 2022.

Key facts
  • WhiteArmor demanded USD 5,000,000 in bitcoin within 30 days.
  • The gang claims about 100GB, nearly 30,000 driver records, and 33 super-admin accounts.
  • It also claims 27,842 device logs with phone numbers, emails, and IMEI numbers.
  • Maersk acquired LF Logistics, developer of the OCF platform, from Li & Fung in 2022.
  • Maersk has not confirmed the data claims or named the breached system.
  • Company says no other systems, APIs, or EDI integrations were affected.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 11, 2026Maersk confirms extraction from one acquired legacy system · Security Affairs

What each outlet adds

beyond the shared facts
  • BleepingComputerReports no impact on APIs or EDI and lists claimed data types.
  • Security AffairsMaersk unnamed the system and has not linked LF Logistics.
Products
OCF/LF Logistics
Threat actors
WhiteArmor
Victims
Maersk
Countries
Denmark

Coverage

oldest first · one row per article · UTC
  1. · 5h ago BleepingComputerFirst report

    Maersk confirms breach as WhiteArmor demands $5 million

    The gang claims about 100GB from the former LF Logistics platform, while Maersk says operations are unaffected.

  2. · 58m ago Security Affairs

    WhiteArmor demands $5 million from Maersk, claims 100GB theft

    Maersk confirms extraction from one acquired legacy system but says findings suggest no sensitive data was disclosed.