Shipping giant Maersk has confirmed that a threat actor breached systems belonging to a company it previously acquired and stole data.
Ransomware group WhiteArmor claimed the attack over the weekend, threatening that it would release about 100GB of information allegedly exfiltrated from the company’s logistics and supply-chain platform.
Legacy system compromise
The investigation into the incident is ongoing, but the shipping firm says that current evidence indicates that “no sensitive data has been disclosed.”
Maersk added that it does not expect disruptions to operations, and assures customers that they can continue booking and managing shipments through its systems as usual.
“The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI,” Maersk states.
A.P. Moller–Maersk is a Danish shipping and logistics group and one of the world’s largest container carriers by fleet capacity. The company operates ocean freighters, port terminals, warehouses, and air and land transport services across 130 countries.
It has 700 container ships, roughly 13.5% of the global fleet capacity, 60 terminals in 35 countries, and employs 100,000 people. Last year, Maersk reported $54 billion in revenue and $2.9 billion in net profit.
Maersk said the incident has been isolated, but did not share details about the affected system, the compromised data types, or when the intrusion occurred.
BleepingComputer reached out to Maersk with additional questions, but we have not heard back as of publishing.
Ransomware gang claims 100GB data theft
Over the weekend, the WhiteArmor ransomware gang listed Maersk on its data leak site and publicly asked for a ransom payment of $5million.
“Your contract-logistics arm, the former LF Logistics, runs fulfilment for many of the world’s largest consumer brands. Five million dollars is roughly four hours of that EBITDA,” the threat actor said.
“You have 30 days to contact us and pay USD 5,000,000 in bitcoin,” reads WhiteArmor’s public message.
WhiteArmor claims to hold approximately 100 GB of data allegedly stolen from Maersk’s OCF/LF Logistics platform, which the group is using to support its extortion demands.
In 2022, Maersk acquired LF Logistics, the original developer of the OCF/LF Logistics platform, from the Li & Fung Group.
According to the threat actor, the data they hold includes nearly 30,000 drivers records, plaintext passwords, 33 SUPER_ADMIN accounts (the most privileged on a system), signed delivery receipts, and 14.44 inventory rows with purchase orders and Advance Shipping Notice (ASNs).
The hacker also claims to hold 27,842 mobile device logs that include phone numbers, emails, and IMEI (International Mobile Equipment Identity) numbers.
WhiteArmor ransomware lists Maersk, asks for $5 million
source: BleepingComputer
Maersk noted in the disclosure today that “the incident is isolated to a local system” and that it would notify customers “as more relevant information becomes available, and if we identify any need to inform impacted parties of any further findings.”
“As always, please treat any unexpected communications claiming to relate to this matter with caution and verify them through your usual Maersk contact,” the company advises.
In 2017, Maersk was hit by NotPetya ransomware, forcing it to rebuild an infrastructure of over 4,000 servers and 45,000 workstations from scratch.
At the time, the company was forced to operate without IT for ten days, incurring damages of up to $300 million.
Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.See what’s getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.
Click Here For The Original Source.
——————————————————–
