Maersk legacy system breach and WhiteArmor ransom demand
Maersk says attackers breached a legacy IT system acquired from LF Logistics and stole data from a platform used by other logistics companies. The WhiteArmor gang is demanding $5 million in bitcoin, while Maersk says no sensitive data has been disclosed.
IllustrationThe story so far
On 11 November 2026, Maersk confirmed that attackers breached a legacy IT system acquired from LF Logistics. The company said the breach affected a platform that holds information for other logistics companies. The WhiteArmor ransomware gang claimed responsibility, demanding $5 million in bitcoin and threatening to release 100GB of data. It said the stolen material included more than 16,000 driver passwords stored in plain text.
By 12 November 2026, Maersk said it found unauthorized access and data extraction on a local legacy system from an earlier acquisition. WhiteArmor cited driver records, staff accounts and mobile device logs from an LF Logistics platform. Maersk said the incident is isolated to a local system and that findings strongly suggest no sensitive data has been disclosed. It also said customer operations are not disrupted, though the investigation is ongoing.
Latest updates
2 updates · newest first- 12 NovNew development
Maersk Confirms Data Theft Amid $5 Million WhiteArmor Extortion
Maersk said it found unauthorized access and data extraction on a local legacy system from an earlier acquisition, without naming the business. The WhiteArmor group claims 100GB from an LF Logistics platform and demands $5 million in bitcoin, citing driver records, staff accounts and mobile device logs. Maersk said findings strongly suggest no sensitive data was disclosed and that customer operations are not disrupted.
SecurityWeek ↗
Infosecurity Magazine ↗
- 11 NovNew development
Maersk confirms data breach at legacy system as WhiteArmor demands $5 million
Maersk confirmed that attackers breached a legacy IT system acquired from LF Logistics, stealing data from a platform that holds information for other logistics companies. The WhiteArmor ransomware gang claimed responsibility, demanding $5 million in bitcoin and threatening to release 100GB of data, including over 16,000 driver passwords stored in plain text. Maersk stated that the incident is isolated to a local system and that no sensitive data has been disclosed, though the investigation is ongoing.
Cybernews ↗
BleepingComputer ↗