What happened. Maersk posted an IT security incident notice on Nov 11 confirming unauthorised access and data extraction from "one of our local legacy systems from a previous acquisition." It says the issue is isolated to that system, with no sign of impact on other Maersk systems or on customer and partner systems connected through APIs and EDI, and that customers can keep booking and managing shipments as usual. Maersk has not named an attacker or said how many people are affected.
The extortion claim. WhiteArmor, a group ransomware.live first logged on Nov 7 and flags as an emerging, unverified actor, listed Maersk on its leak site and asked for $5 million in bitcoin within 30 days. It claims about 100 GB from the OCF / LF Logistics platform, including 29,297 driver records (16,093 with plaintext passwords), 16,123 staff accounts including 33 SUPER_ADMIN accounts, 64,665 signed delivery receipts and 14.44 million inventory rows. These are the group's figures; Maersk has not confirmed them or linked the incident to WhiteArmor. Cybernews researchers tied the breach to LF Logistics, which Maersk bought from Li & Fung in 2022, and reporting so far points to data theft and extortion rather than encrypted systems.
Why this matters to an enterprise. This is the M&A security debt problem in plain sight: a system bought in a deal four years ago, still running on its own, with (if the claim holds) plaintext passwords and dozens of top-level admin accounts. Contract-logistics platforms also hold other companies' orders and shipment data, so brands that use Maersk for warehousing and fulfilment are the ones who should be asking questions now.
Do now. If you are a Maersk contract-logistics customer, ask your account team whether your data sat on the former LF Logistics platform and get the findings in writing. Watch for phishing that reuses real order or delivery details. If you run acquisitions, inventory every inherited app still running outside your identity stack, force it behind your SSO, and kill any shared or super-admin accounts left over from the old owner.