The Legacy System Let Them In. The Ransom Is $5 Million.

A.P. Moller-Maersk confirmed on Wednesday that attackers broke into a local legacy system inherited through an acquisition and extracted data. The disclosure landed days after the WhiteArmor extortion group listed the shipping giant on its leak site, claiming about 100 GB of logistics data and demanding $5 million in Bitcoin.

Maersk is one of the world’s largest container carriers — 700 ships, about 13.5% of global fleet capacity, 100,000 employees, $54 billion in revenue last year. A breach at that scale gets attention. But this story is really about two different things: what Maersk confirmed, and what a gang claims. They are not the same.

What Maersk confirmed

Maersk’s statement is short and careful. An unauthorized party accessed a local system that came with a company Maersk acquired, and extracted data from it. The incident is isolated to that system, the company says, and so far there is no sign it touched other Maersk systems, or the systems of customers and partners that connect through APIs and electronic data interchange (EDI). “Our findings so far strongly suggest no sensitive data has been disclosed,” Maersk said. The investigation is ongoing, and the company says it will tell customers more as findings develop — and warn them if anyone needs to be informed.

Maersk did not say which system was hit, what data was taken, or when the intrusion happened. It also did not name WhiteArmor, or confirm any link between the gang’s claims and the incident it is investigating.

What WhiteArmor claims

Over the weekend, WhiteArmor listed Maersk on its data leak site with a public message: “You have 30 days to contact us and pay USD 5,000,000 in bitcoin.” The deadline, by that count, is December 7. The group says it holds about 100 GB of data from Maersk’s OCF/LF Logistics platform — the contract-logistics arm Maersk built from LF Logistics, which it acquired from Hong Kong’s Li & Fung Group in 2022 for $3.6 billion. That arm runs fulfilment for many of the world’s largest consumer brands.

The claimed haul is specific and ugly: 29,297 driver records, 16,093 of them with plaintext passwords; 16,123 employee accounts, including 33 SUPER_ADMIN accounts — the most privileged accounts on a system; 18,913 delivery recipients with names and street addresses; 64,665 signed delivery receipts; 14.44 million inventory rows with purchase orders and shipping notices; and 27,842 mobile device logs containing phone numbers, emails, and IMEI numbers.

Every one of those figures comes from the gang. No samples have been independently verified, and Maersk has not confirmed the dataset, the volume, or WhiteArmor’s responsibility. Treat the numbers as a claim, not a count.

Why an old system is the story

Acquired systems are where breaches hide. A platform built by another company, running older controls, often sits outside the parent’s security view for years. Maersk’s statement calls it a “local system” — and the fact that the incident stayed contained there is the good news. The bad news is what the gang says it found inside: plaintext passwords and super-admin accounts. Passwords stored in plain text — readable by anyone who gets in — are a failure that should have died a decade ago, and 33 super-admin accounts in one platform is a full takeover waiting to happen.

There is a longer shadow here too. In 2017, the NotPetya attack crippled Maersk, forcing it to rebuild more than 4,000 servers and 45,000 workstations from scratch and operate without IT for ten days, at a cost of up to $300 million. This time, by contrast, Maersk says there is no operational disruption and customers can keep booking and managing shipments as usual. The difference between a worm that spreads everywhere and a legacy system that stays contained is the whole story.

What to do

Verify any message about this incident through your usual Maersk contact. Maersk itself warned customers to treat unexpected communications with caution — breach news is prime material for phishing, and the gang’s own message proves the topic is live.

Inventory the legacy systems that came with any acquisition. If your company bought another business, its old platforms are your attack surface now. Segment them from the rest of your network until you know what is inside.

Hunt for plaintext passwords in any acquired system. 16,093 of them is the number that should keep an admin up at night — and it is the easiest finding to fix.

Count the super-admin accounts in your legacy platforms and cut them to the minimum. Thirty-three is not a minimum.

Maersk’s investigation is still open, and the gap between what it confirmed and what WhiteArmor claims may close in either direction. Until then, the lesson is the boring one that keeps being true: the system you forgot you owned is the one that gets breached. The same supplier-side pattern showed up in the Arkéa heist, which ran through a service provider, and in the Qubole breach, where one vendor key opened every customer’s cloud.