Maersk Confirms Data Breach on Legacy LF Logistics System as WhiteArmor Ransomware Demands $5 Million
Shipping giant Maersk has confirmed a data breach affecting a company it acquired in 2022, with the WhiteArmor ransomware group claiming responsibility and demanding a $5 million ransom payment. The threat actor alleges theft of approximately 100 GB of data from the OCF/LF Logistics platform, including nearly 30,000 driver records, plaintext passwords, 33 SUPER_ADMIN accounts, signed delivery receipts, and 27,842 mobile device logs. Maersk stated that the incident is isolated to a local system with no evidence of impact on other systems, customer data, or operations, and no sensitive information has been disclosed so far. The company emphasized that customers can continue using its booking and shipment management systems without disruption. This marks the second major ransomware incident for Maersk, following the 2017 NotPetya attack that forced the rebuild of over 4,000 servers and 45,000 workstations at a cost of up to $300 million. WhiteArmor has listed Maersk on its data leak site and given the company 30 days to pay the ransom in Bitcoin, highlighting the financial scale of the targeted logistics operations.
BleepingComputerNov 11, 2026Translated from English