Maersk confirms breach of inherited LF Logistics system as WhiteArmor demands $5 million (2026)

On 11 November 2026, Maersk — the Danish shipping and logistics giant and one of the world's largest container carriers — confirmed that attackers had breached a legacy system and extracted data, after the extortion group WhiteArmor listed the company on its data-leak site over the preceding weekend and demanded a $5 million ransom. Maersk said the affected system was a local platform it had inherited, which researchers linked to LF Logistics, a supply-chain provider Maersk acquired from the Li & Fung Group in 2022.

What happened

Maersk said it was investigating a cyber-security incident involving unauthorised access and data extraction, and characterised the breach as "isolated to a local system" belonging to the acquired LF Logistics business. The company stated that current evidence indicated no sensitive data had been disclosed, that it had found no impact on other Maersk systems, and that customer and partner systems connected via APIs and EDI were unaffected. Maersk added that it did not expect disruption to operations, and that customers could continue booking and managing shipments as usual.

What the attackers claim

WhiteArmor's leak-site listing claimed to hold roughly 100 GB of data — described elsewhere as more than 16,000 files — including nearly 30,000 driver records, plaintext passwords, 33 "super admin" accounts, signed delivery receipts, and some 27,842 mobile-device logs containing phone numbers, email addresses and IMEI identifiers. The group set a deadline of 30 days from its listing. These figures come from the threat actor and had not been independently verified; Maersk disputed that any sensitive data was exposed.

Why it matters

Maersk is acutely sensitive to cyber risk: the 2017 NotPetya wiper tore through its network, forcing it to rebuild roughly 4,000 servers and 45,000 workstations at a cost of up to $300 million. This incident is far narrower — confined, Maersk says, to an inherited peripheral system rather than its core booking and container operations — but it underscores how acquisitions can import legacy infrastructure and unfamiliar exposure, and how extortion groups increasingly weigh a target's reputation and historical scars when setting their demands.