Danish shipping giant A.P. Moller-Maersk has confirmed that hackers accessed an older IT system and extracted data, prompting an investigation into a suspected ransomware-related incident. The company says the intrusion has been contained and that its global shipping operations remain unaffected.
Maersk disclosed the breach on November 11, 2026, explaining that the compromised system had been inherited through a previous corporate acquisition. Its cybersecurity team secured the affected environment and began examining the extent of the unauthorized activity.
The incident has been linked to LF Logistics, a supply chain management company acquired by Maersk in 2022. The affected platform supported logistics operations and contained information associated with transport and delivery services.
A ransomware group calling itself WhiteArmour has claimed responsibility for the intrusion. The attackers are demanding $5 million in Bitcoin and have threatened to publish allegedly stolen information unless the company pays within 30 days.
According to the group’s claims, the stolen material amounts to approximately 100GB and includes driver records, delivery receipts, inventory information, purchase orders, and administrative account details. The attackers also allege that they obtained more than 16,000 driver passwords stored in plaintext.
However, Maersk disputes the password allegations. The company confirmed that the incident described in its public notice corresponds to WhiteArmour’s claim but stated that passwords were stored in protected form. According to Maersk, the attackers obtained single-use codes that have since expired.
The company has not independently confirmed the other categories of information advertised by the group or the claimed volume of stolen data. Its preliminary investigation suggests that no sensitive information was disclosed.
Maersk also reported finding no evidence that the attackers accessed its broader corporate infrastructure or systems operated by customers and business partners. This includes external platforms connected through application programming interfaces and electronic data interchange services.
The company expects no disruption to shipping activities. Customers can continue booking shipments, tracking cargo, and managing logistics through its existing platforms.
The intrusion method remains undisclosed, and Maersk has not identified when the attackers first entered the affected environment. It is also unclear whether the incident involved file encryption or was limited to unauthorized access and data extraction.
The attack recalls Maersk’s much larger cybersecurity crisis in 2017, when the NotPetya malware disrupted its global operations and forced the company to rebuild thousands of servers and computers. That incident resulted in estimated losses of approximately $300 million.