The company said in a security advisory dated 11 November that the compromised system was inherited through an earlier acquisition. Its cybersecurity team began investigating after detecting the intrusion and took steps to secure the affected system. The investigation remains open. Maersk did not disclose whether the system was still actively used, how its security team discovered the intrusion or whether the company had retained external specialists to assist with the examination.
Maersk said it had found no indication that the incident spread to its other systems or affected customers and business partners connected to its technology platforms. It expects no interruption to shipping operations and said customers could continue booking and managing cargo through its normal services.
The disclosure follows an extortion claim by a group calling itself WhiteArmor, which has named Maersk on a criminal data-leak website and demanded $5 million in bitcoin. The group claims to possess approximately 100 gigabytes of information from a logistics platform associated with a business acquired by Maersk. Those assertions have not been independently substantiated.
Maersk has not publicly identified the compromised application, confirmed any connection with WhiteArmor or specified the categories and volume of information extracted. Its assessment that sensitive information was not disclosed is preliminary, rather than a definitive finding about the contents of the stolen material.
The group alleges that the material includes driver records, passwords, administrator accounts, delivery documents, inventory information and mobile device logs. It has also claimed access to contact details and device identifiers. Neither the authenticity of these purported records nor the group’s claimed access privileges has been established by Maersk.
The extortion demand reportedly allows 30 days for payment. There is no verified evidence that Maersk has paid a ransom, that its files were encrypted or that the attackers interfered with vessel movements, terminal operations or shipment bookings. The company’s advisory did not describe the method used to enter the affected system.
The distinction between confirmed data extraction and alleged exposure of sensitive records is central to the investigation. Unauthorised copying establishes that information left the affected environment, but does not by itself establish that customer credentials, personal details or commercially confidential records were among the extracted files.
Maersk said its investigators had so far found no sign of damage to systems belonging to customers or partners that communicate with its platforms through application programming interfaces and electronic data interchange. These connections support the automated exchange of shipment and business information between logistics companies and their customers.
The company stated: “Our findings so far strongly suggest no sensitive data has been disclosed.” It also said the incident was confined to a local system, although it did not explain how long the unauthorised access lasted or when the data was removed.
The system’s origin in an acquisition has attracted attention because Maersk bought LF Logistics, a contract logistics business previously owned by Li & Fung, in 2022. WhiteArmor has identified an OCF/LF Logistics platform in its allegations. Maersk, however, has not confirmed that this was the system involved in the incident.
That uncertainty leaves several important questions unresolved, including the identity of the intruder, the entry point, the affected records and whether any individuals or corporate customers will require direct notification. The company has not announced a timetable for completing its forensic investigation. It has also not said whether any stolen information has appeared publicly or been shared with third parties.
Maersk operates an extensive network of container shipping and logistics services, making the availability of its digital booking and cargo management platforms important to customers across international supply chains. Its assurance that those services remain usable addresses the immediate operational concern, without settling questions about the extracted information.
The company said it would provide further updates when relevant information became available and would contact affected parties if its investigation established a need to do so. It has not publicly announced any regulatory notification or identified specific customers whose information was compromised.
Customers were also advised to exercise caution over unsolicited communications referring to the incident. Maersk urged them to verify unexpected messages through their established company contacts rather than relying on claims made by unfamiliar senders.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
