What system was breached and when did the incident occur?

An unauthorised access and data extraction incident affected a legacy local IT system inherited through acquisition, likely connected to LF Logistics (acquired by Maersk in 2022). The breach occurred over the weekend of November 7-8, 2026, with Maersk publicly disclosing it on November 11, 2026.

Has there been any operational disruption to Maersk's customer-facing services?

No. Maersk has found no indication of operational disruption. Digital platforms remain available, and customers can continue booking and managing shipments as usual. Booking and shipment-management services are operating normally with no confirmed impact on API or EDI connections.

What data does the ransomware group claim to have obtained?

According to reports, WhiteArmor claims to have obtained approximately 100 GB of data, including more than 29,000 driver records, over 16,000 staff accounts, invoices, receipts, mobile numbers, and email addresses. However, these claims remain unverified and Maersk has not confirmed the connection to its investigation.

Does this incident affect customer or partner systems connected to Maersk?

Maersk has found no indication that other Maersk systems or customer and partner systems connected through integrations such as APIs and EDI have been impacted by the incident.

What should customers do in response to this incident?

Maersk is advising customers to remain cautious about unexpected communications claiming to relate to the incident and to verify suspicious messages through their usual Maersk contacts. Maersk will keep customers informed as investigation progresses and will contact affected parties if necessary.

Technology & Innovation

Moderate

Maersk Cyber Incident: Legacy System Breach, No Ops Impact Yet

Nov 15, 2026

Get tomorrow's supply chain signal

Daily supply-chain brief. Free, unsubscribe anytime.

The signal

A.P. Moller - Maersk disclosed a cybersecurity incident involving unauthorised access to a legacy local IT system, likely connected to its 2022 acquisition of Hong Kong-based LF Logistics. The breach occurred over November 7-8, 2026, with formal public disclosure on November 11.

A ransomware group named WhiteArmor has claimed responsibility and allegedly obtained approximately 100 GB of data, including driver records and staff accounts, demanding USD 5 million in bitcoin. Critically, Maersk's investigation has found no evidence that sensitive customer data was compromised, that other systems were affected, or that operational disruptions have occurred. The company's booking and shipment management platforms continue operating normally, with no confirmed impact on API or EDI integrations with customers and partners.

This incident highlights ongoing vulnerabilities in integrated legacy systems from corporate acquisitions and underscores the importance of cybersecurity hygiene during M&A transactions.

#maersk-cybersecurity

#data-breach

#ransomware-threat

#legacy-systems

#supply-chain-security

#operational-continuity