WhiteArmor Claims to Have Stolen 100GB of Data and Demands $5M in Bitcoin
Tiffany Wang •
November 11, 2026
Image: Shutterstock
One of the world’s largest container shipping companies is investigating a potential ransomware attack involving unauthorized access to a legacy system inherited from a previous acquisition.See Also: Your Face Is Your Boarding Pass: How Biometric Identity Is Redefining the Way We Travel
Danish multinational A.P. Moller-Maersk said Wednesday no sensitive data has been stolen based on its findings to date, after a newly emerged data extortion and ransomware group called WhiteArmor took responsibility for the hack Saturday.
The group claims to hold around 100 gigabytes of data from Maersk, including driver records, staff accounts, delivery recipients’ names and addresses and mobile device logs containing phone numbers, emails and device identifier numbers.
Active since Oct. 21, WhiteArmor has claimed attacks against more than 20 organizations across the globe, ranging from major logistics companies to a furniture retailer and an electronics manufacturer. An alleged attack against Arkansas freight shipper J.B. Hunt provoked a putative class action lawsuit.
The group threatened to make the stolen files from Maersk public if the firm did not pay $5 million worth of bitcoin in 30 days. WhiteArmor told ISMG in an email Wednesday that Maersk had not contacted the group to negotiate. ISMG reached the group through an email address listed on its leak site.
“Your contract-logistics arm, the former LF Logistics, runs fulfilment for many of the world’s largest consumer brands,” states the leak site. “Five million dollars is roughly four hours of that EBITDA.”
Maersk operates more than 700 container vessels and serves over 100,000 customers across 130 countries. Its latest quarterly earnings showed earnings before any deductions grew 75% to $4.7 billion.
The shipping giant said the incident is contained in a local system and does not impact other company systems or partner systems that connect to Maersk.
“We do not anticipate disruption to operations for customers at this time, and customers can continue to use Maersk platforms to book and manage their shipments as usual,” Maersk said.
Maersk previously suffered the NotPetya ransomware attack in 2017 and had to shut off its network for 10 days. The company had to install new servers, devices and applications and estimated the cost of the disruption at about $300 million.
——————————————————–
Click Here For The Original Source.
