---
title: Maersk confirms unauthorised access and data theft from a legacy system it inherited through an acquisition | ctxsec
url: https://ctxsec.com/items/maersk-confirms-data-extraction-legacy-acquired-system-whitearmor-claim-nov-11
description: "A.P. Moller - Maersk says it found unauthorised access and data extraction from one of its local legacy systems that came with a previous acquisition. Maersk says its findings so far strongly suggest no sensitive data has been disclosed, that the incident is isolated to that system with no sign of impact on other Maersk systems or on customer and partner API and EDI connections, and that it does not expect operational disruption. The statement follows the WhiteArmor extortion group listing Maersk on its leak site; Maersk does not name the group."
status: "official (Maersk statement, Nov 11, 2026); WhiteArmor's data claims are the group's own and not confirmed by Maersk"
published: 2026-11-11
---

> A.P. Moller - Maersk says it found unauthorised access and data extraction from one of its local legacy systems that came with a previous acquisition. Maersk says its findings so far strongly suggest no sensitive data has been disclosed, that the incident is isolated to that system with no sign of impact on other Maersk systems or on customer and partner API and EDI connections, and that it does not expect operational disruption. The statement follows the WhiteArmor extortion group listing Maersk on its leak site; Maersk does not name the group.

[← Cybersecurity News](/news) · [markdown](/items/maersk-confirms-data-extraction-legacy-acquired-system-whitearmor-claim-nov-11.md)

official (Maersk statement, Nov 11, 2026); WhiteArmor's data claims are the group's own and not confirmed by Maersk

2026-11-11 11:37 AM ET

### Maersk confirms unauthorised access and data theft from a legacy system it inherited through an acquisition

- **Maersk says:** the investigation is ongoing, the affected system has been secured, customers can keep booking and managing shipments as usual, and it will inform impacted parties if it finds a need to.
- **The group's claim (not confirmed by Maersk):** WhiteArmor says it holds about 100 GB from the former LF Logistics contract-logistics platform, including driver and employee accounts, and is demanding US$5 million in bitcoin. Treat those figures as the attacker's claim.
- **For partners and LF Logistics users:** watch for phishing that references shipments, delivery receipts or account resets, and change any password reused from that platform.

Sources: [Maersk: IT security incident (Nov 11, 2026)](https://www.maersk.com/news/articles/2026/11/11/it-security-incident)