Maersk breach exposes acquisition risk: legacy LF Logistics system hit

Maersk confirmed on November 11 that an unauthorized party accessed and extracted data from a legacy system the company inherited through a previous acquisition. The shipping giant said its cybersecurity team discovered the issue, launched an investigation, and secured the system.

The compromised system came from LF Logistics, a supply chain provider Maersk acquired in 2022. Maersk confirmed the link after researchers identified it. The ransomware group WhiteArmor claimed the attack over the weekend, saying it stole roughly 100GB of logistics and supply-chain data and demanding $5 million.

WhiteArmor claimed it exfiltrated more than 16,000 driver passwords. Maersk said the attackers only obtained single-use codes. The company said its findings so far strongly suggest no sensitive data has been disclosed.

Maersk described the incident as isolated to a local system, with no indication of impact on other Maersk systems or on customer and partner systems connected through APIs and EDI. The company said it does not anticipate disruption to operations for customers.

What remains unclear is when the unauthorized access and extraction occurred. Maersk disclosed the incident on November 11 but has not specified the timing. WhiteArmor claimed the attack happened over the weekend before the disclosure.

The incident fits a pattern that security teams at large logistics firms know well. Acquisitions bring inherited systems, and inherited systems often carry unpatched vulnerabilities, undocumented access paths, and credentials that outlive the deal. Maersk's containment narrative — no sensitive data, no operational impact — may hold. But the gap between that account and WhiteArmor's 100GB claim will be tested as the investigation continues and as the group either publishes samples or does not.

For now, the concrete facts are these: a legacy system from a 2022 acquisition was breached, data was extracted, Maersk says the data was limited to single-use codes, and an extortion group is demanding $5 million. The rest is a dispute over scope that only forensic evidence will settle.