Maersk says data was taken from a legacy system left over from an acquisition

A.P. Moller-Maersk said on November 11, 2026 that it had found unauthorised access and data extraction from one of its local legacy systems, left over from a previous acquisition. The shipping and logistics group says an investigation is under way, and that what it has found so far strongly suggests no sensitive data has been disclosed. Here’s what it has told customers, and what a ransomware group is claiming separately.

What Maersk has said

In an advisory posted on its site, Maersk says its cyber security team launched a full investigation as soon as it discovered the issue, and has taken steps to secure the affected system. The investigation is still going.

The company is careful about what it will stand behind today:

• The incident is isolated to a local system.
• It has found no indication that other Maersk systems were affected, or that customer and partner systems that connect to Maersk through integrations such as APIs and EDI were affected.
• It does not expect disruption to customer operations, and says customers can keep booking and managing shipments as usual.
• If it later needs to tell people who were affected, it says it will.

Maersk has not, in this notice, named the acquired company, the system, the kinds of data involved, or when the access began. It also has not named a threat group.

It asks customers to treat unexpected messages that claim to be about this incident with caution, and to check them through their usual Maersk contact.

What a ransomware group is claiming

Separately, BleepingComputer reports that a ransomware group calling itself WhiteArmor listed Maersk on its leak site over the weekend and asked for a $5 million payment in bitcoin within 30 days. The group claims it took about 100 GB of data from Maersk’s contract-logistics platform, which it describes as the former LF Logistics system. Maersk completed its acquisition of LF Logistics in August 2022.

WhiteArmor’s public message, as quoted by BleepingComputer, also claims the haul includes driver records, plaintext passwords, highly privileged accounts, delivery receipts, inventory and shipping records, and mobile device logs with phone numbers, emails and IMEI numbers.

Those are the group’s claims, not Maersk’s. Maersk has not confirmed the volume, the platform or the types of records, and it has said its findings so far strongly suggest no sensitive data has been disclosed. Claims on a leak site are a reason to stay alert, not proof of what was taken.

What you can do

1. Use your usual Maersk channels. If you book or track freight with Maersk, go to the official site or app, or contact your usual representative. Don’t rely on a surprise email, chat or invoice that mentions this incident.
2. Watch for follow-up from Maersk. The company says it will update customers if it needs to tell people whose information was involved.
3. Treat unexpected payment or “verify your account” messages as suspect, even if they use Maersk’s name or refer to a shipment you really have.
4. If you work at a company that shares data with Maersk, wait for your own security team’s guidance rather than clicking links in unsolicited notes about the incident.

How Frame helps

Maersk has not published a list of affected people or the kinds of personal details involved, so there isn’t a breach record to add in Frame yet. If a later notice names what was taken, add it to a verified email in Frame for a short checklist. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.

Related coverage

• WorkOS says an AI-assisted attack reached its sales tool, with customer contacts and Slack excerpts: another case where a company had to explain access that started at a connected system.
• Fake hotel payment pages now show your real name, dates and room price: how a familiar name and real details can still hide a scam.

Sources

• A.P. Moller-Maersk, IT security incident, November 11, 2026
• BleepingComputer, Maersk confirms data breach as WhiteArmor ransomware demands $5 million, November 11, 2026
• A.P. Moller-Maersk, A.P. Moller - Maersk completes acquisition of LF Logistics, August 31, 2022