The shipping company A.P. Moller-Maersk confirmed this Wednesday, November 11, a cybersecurity incident that enabled unauthorized access to and extraction of data from one of its systems. The Danish company has launched an investigation to determine the scope of what happened and says that, based on the checks carried out so far, there is no indication that sensitive information has been disclosed or that the incident has affected its operations.
The compromised system is an on-premises computer platform that Maersk incorporated into its technology infrastructure following a previous corporate acquisition. The company has not publicly identified which system was affected or specified the nature or volume of the data extracted.
According to Maersk’s official statement, its cybersecurity team launched an investigation after detecting the incident and took steps to protect the affected system. Initial checks indicate that the unauthorized access is limited to that infrastructure, with no evidence that the group’s other computer systems have been affected.
The shipping company has also said it has found no indication of problems with the connections used by customers and partners through application programming interfaces (APIs) or electronic data interchange (EDI) systems, tools commonly used to integrate contracting, documentation, and cargo tracking processes.
Maersk does not expect disruptions to its logistics and maritime services as a result of the incident. Customers can continue using its digital platforms to make bookings and manage their shipments as usual, the company said.
Confirmation of the incident coincides with a claim by the cybercriminal group WhiteArmor, which says it stole approximately 100 gigabytes of information linked to a logistics platform associated with Maersk.
According to information published by the group and reported by media outlets specializing in cybersecurity, the data allegedly obtained may include 29,297 driver records, more than 16,000 employee accounts, and documentation related to deliveries, orders, and warehouse operations. The attackers claim that some of the records contain unencrypted passwords.
WhiteArmor is also demanding a payment of five million dollars in bitcoin and threatening to publish the data if it does not receive the amount demanded.
These claims come exclusively from the group behind the allegation and have not been independently verified. Maersk has also not publicly confirmed that WhiteArmor is behind the unauthorized access it is investigating or that the information the group allegedly stole comes from the affected system.
The Cybernews investigation team has linked the attackers’ claims to LF Logistics, a supply chain management company acquired by Maersk in 2022. However, the shipping company has not officially identified the subsidiary or technology platform involved.
The company has said it will keep its customers informed as new investigation results become available and will communicate any circumstances requiring specific notification to affected parties. It has also recommended verifying through the usual channels any unexpected communication that refers to the security incident.
