- Maersk discloses cyberattack on a legacy system from an acquired logistics company, with attackers allegedly stealing 100GB of data
- A ransomware group is demanding $5 million and threatening to leak records, passwords, and logistics information
One of the world's largest shipping and logistics companies, A.P. Moller–Maersk (often just called Maersk) has confirmed it recently suffered a cyberattack in which it lost sensitive data from one of its earlier acquisitions.
The criminals are now trying to pressure the company into paying a ransom, threatening to release all of the stolen information on the dark web.
Maersk issued an incident report, saying cybercriminals broke into a unnamed company it had previously acquired which reportedly operated a legacy system that the attackers managed to pierce.
“Our findings so far strongly suggest no sensitive data has been disclosed,” Maersk said, “The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI.”
WhiteArmor takes the blame
The company said it does not expect the attack to disrupt its operations, and told its customers they can continue using its platforms to book and manage their shipments as usual.
But just because the data has not yet leaked, it doesn’t mean it won’t happen. According to , a hacking group calling itself WhiteArmor added Maersk to its data leak site and told the company to pay $5 million in bitcoin - or else.
"Your contract-logistics arm, the former LF Logistics, runs fulfillment for many of the world's largest consumer brands. Five million dollars is roughly four hours of that EBITDA," the threat actor said. "You have 30 days to contact us and pay USD 5,000,000 in bitcoin."
Companies usually don’t jump on the opportunity to pay the cybercriminals, so it’s safe to assume Maersk will ignore this invitation, and the data will leak.
However, we now know who it was stolen from - LF Logistics. This was an independent Hong-Kong-based third-party logistics company specializing in warehousing and ecommerce fulfillment. Maersk bought it in 2022 for $3.6 billion and integrated it into its own global Logistics & Services division, where it effectively ceased to exist as a separate entity.
Risky business
WhiteArmor claims to have stolen 100GB of data, including almost 30,000 driver records, passwords in plaintext, 33 SUPER_ADMIN accounts, signed delivery receipts, and 14.44 inventory rows with purchase orders and Advance Shipping Notices (ASN). Furthermore, it claims to have nabbed 27,842 mobile device logs containing phone numbers, email addresses, and even IMEI numbers.
If the claims are true, then this could be a major issue for Maersk. Passwords in plaintext and SUPER_ADMIN accounts means the company’s IT team will have to rotate all secrets to secure their premises. If any of the passwords are also used elsewhere, those services are at risk, as well. Details such as phone numbers and IMEI numbers are ideal for phishing and vishing attacks which have proven, time and time again, their destructive potential.
As one of the world’s largest container shipping companies, Maersk employs more than 100,000 people and generates more than $50 billion in revenue, as its global network includes more than 60 terminals and over 500 warehousing facilities.
In 2017, cybercriminals utilized the infamous NotPetya attack to wreak havoc on Maersk and bring its entire global network to a standstill, leading to damage that cost the business between $250 and $300 million.
