A.P. Moller-Maersk, one of the world's largest shipping and logistics groups, says attackers gained unauthorised access to one of its local legacy systems and extracted data. The company disclosed the incident on 11 November 2026. It says the affected system came from a previous acquisition.

Trade publications, including Smart Maritime Network, trace the system to LF Logistics, which Maersk bought from the Li & Fung group in 2022.

What Maersk says

  • Its findings so far strongly suggest that no sensitive data has been disclosed.
  • It has found no indication of impact on other Maersk systems.
  • It has found no impact on customer and partner systems connected through integrations such as APIs and EDI.
  • Its booking and shipment management platforms continue to operate normally.

What the attackers claim

A group calling itself WhiteArmor has claimed responsibility. According to reports, it says it took around 100 GB of data and demands $5 million, with a 30-day deadline. Maersk has not confirmed these claims or linked the incident to the group. Claims on leak sites are often exaggerated, and they should be treated as unverified until the company or investigators confirm them.

Why legacy systems are a weak spot

Companies that grow by acquisition often inherit IT systems that are kept running for local operations, but are not fully moved onto the parent company's security standards. These systems can have older software, separate user accounts and less monitoring. Attackers look for exactly such gaps.

Maersk knows the cost of a cyberattack. In 2017, the NotPetya malware disrupted its operations worldwide. This time the company reports no operational disruption.

What other companies can learn

  • Inventory everything you bought. Every acquired system needs an owner, a security review and a date for migration or shutdown.
  • Separate and monitor. Legacy systems should be isolated from core networks and covered by the same logging and alerts.
  • Check integrations. APIs and EDI links to customers and partners need their own access controls and keys that can be revoked quickly.
  • Prepare communication. Customers want to know quickly whether their data or shipments are affected.

For shippers in Canada and Germany who work with Maersk, there is no action required based on the company's statement. It is still sensible to watch for phishing emails that use the incident as a pretext, for example fake invoices or shipment notices.