The extortion group WhiteArmor has listed A.P. Møller-Mærsk on its leak site. It claims to have stolen about 100GB of data from the company's OCF / LF Logistics platform, which runs the contract logistics business Maersk took over when it bought LF Logistics. The group is demanding USD 5 million in bitcoin and has set a 30-day deadline. Maersk has not publicly confirmed or denied the claim, and no regulator filing or national CERT statement has been published. Every figure below comes from the attackers' own post, as reproduced by the threat-tracking sites QPulse and HookPhish. Treat them as claims until Maersk or an independent researcher verifies a sample.
What Happened
HookPhish records the listing time as 02:46 UTC on 7 November 2026, with its tracker picking it up at 03:48 UTC the same morning. The ThreatMon Threat Intelligence Team also flagged the listing on 7 November, in a roundup that included an unrelated Incransom claim against an Albanian organisation, according to Undercode News. ThreatMon and Undercode both describe the Maersk entry as an unverified claim. Undercode notes that a company appearing on a leak site does not prove its systems were breached.
The ransom note is aimed squarely at Maersk's finances. It cites the company's founding in 1904, its Copenhagen headquarters, roughly 100,000 staff in about 130 countries, and the group's figures of USD 55.5 billion in 2024 revenue and about USD 12 billion in EBITDA. It then tells Maersk that "five million dollars is roughly four hours of that EBITDA." The group says instructions will follow by email and gives a Session messenger ID and an email address for contact.
No outlet has reported any disruption to operations, and there is no sign that WhiteArmor encrypted anything. Although trackers file it as "ransomware," the claim looks like data theft and extortion only. The two sites that reproduce the note, QPulse and HookPhish, give the same figures. That reflects a single original source, the attackers' post. It is not independent confirmation.
What Was Taken
According to the WhiteArmor post as reproduced by QPulse and HookPhish, the roughly 100GB dataset contains:
- 29,297 driver records, of which the group says 16,093 include plaintext passwords
- 16,123 staff accounts, including 33 with SUPER_ADMIN rights
- 18,913 delivery recipient records with names and street addresses
- 64,665 signed delivery receipts, which the group says add up to 214,107 documents
- 14.44 million inventory rows, 189,248 purchase orders and 334,432 Advanced Shipping Notices (ASNs)
- 27,842 mobile device logs containing phone numbers, email addresses and IMEI numbers
If the data is real, the passwords are the most serious part. Plaintext driver passwords and super-admin account details could let attackers take over accounts, both on the platform itself and anywhere else drivers have reused the same password. Recipient addresses, signed proof-of-delivery documents and device identifiers expose personal data of drivers, warehouse staff and consumers. The purchase orders, ASNs and inventory data are commercially sensitive for the consumer brands whose fulfilment runs through LF Logistics. No sample data has been publicly verified, so the authenticity, age and completeness of these records are unknown.
Why It Matters
Maersk's history makes any claim against it worth watching. The 2017 NotPetya attack began with a hijacked update to the Ukrainian accounting software M.E.Doc and wiped almost every Maersk computer it reached. Bookings, terminal operations and cargo visibility stopped worldwide. Several retrospectives recount it, including Without Borders Systems, YAKU and Azure Blog. Azure Blog notes the company rebuilt its Active Directory only because one domain controller in Ghana happened to be offline during a power cut. The UK and US governments later blamed the Russian military.
The WhiteArmor claim is a different kind of threat. It is about stolen data and extortion, not destruction. But it falls within a wider wave of extortion activity against maritime and logistics companies:
- Marlink advisory (October 2026): Digital Ship reports that Marlink's Cyber Threat Intelligence team warned shipowners after an extortion group named 38 maritime, port and logistics organisations on a leak site on 12 October. Marlink could not verify the data or how the attackers got in. Its advisory did not name the group, and nothing links that campaign to WhiteArmor.
- Port of Tanjung Pelepas: vpn.social reports that a cyberattack briefly stopped terminal operations at this Malaysian transshipment hub, which Maersk operates jointly with MMC. It also reports concern that shipment and personal data may have been exposed. No source connects that incident to WhiteArmor.
For defenders, the main risk lies downstream. Marlink warns that genuine invoices, delivery documents and cargo records are ideal material for convincing payment-diversion and cargo-release fraud. Purchase orders and ASNs from a large third-party logistics provider would give fraudsters real reference numbers, partner names and timelines to quote. Customers of LF Logistics carry that risk whether or not they were ever directly breached.
The Attack Technique
There is no public information on how WhiteArmor got in. The group has not described its method, Maersk has not commented, and no researcher has published technical analysis.
The claimed contents do suggest some possibilities. Plaintext driver passwords point to an application that stored credentials without hashing them, which often means an older or custom-built portal or mobile backend. Records spanning staff accounts, device logs, delivery receipts and inventory suggest the attackers reached the platform's application database or its admin layer, not just one file share. The 33 super-admin accounts would fit either compromised admin credentials or direct access to the database. These are inferences from the group's own list, not established facts. The absence of any reported outage fits a smash-and-grab data theft rather than an attack on the network to deploy ransomware.
What Organizations Should Do
- LF Logistics customers and partners: assume your shared documents may be exposed. Contact your Maersk account team and ask directly whether your purchase orders, ASNs or delivery records were in scope. Don't wait for a public notice.
- Verify payment and cargo-release changes outside email. Following Marlink's guidance, confirm any change to bank details, delivery addresses or release instructions by phone, using a number you already have on file. Expect fraudsters to quote real PO and ASN numbers.
- Reset and audit credentials for any LF Logistics or OCF portal. If your staff or contracted drivers use these systems, force password resets, enable MFA, and look for the same passwords on corporate SSO, email and other carrier portals.
- Review third-party access and data flows. Check supplier and remote-support access, EDI connections and file-transfer activity with logistics providers. Remove stale accounts and access that is broader than needed.
- Check your own applications for unhashed credentials. Driver apps, warehouse handhelds and delivery portals are common places for plaintext or weakly hashed passwords. Audit how they store credentials and limit how many accounts hold super-admin rights.
- Keep logs and watch for leak publication. Retain authentication and transfer logs from any integration with the platform. Monitor WhiteArmor's leak site, because publication would let you confirm whether your data is included.
Sources: Whitearmor Ransomware Group Claims Theft of 100GB of Data from Maer... | maersk Data Breach: Whitearmor Ransomware Claim (Nov 2026) | Incransom Claims New Albanian Victim as WhiteArmor Targets Maersk +... | Maersk and NotPetya: The Cyberattack That Turned Shipping Into Supp... | Port of Tanjung Pelepas Cyberattack Exposes Contract Gaps — vpn.social | Marlink warns shipowners after 38 maritime organisations named in c... | Carrier IT outage: packaging component orders on track · YAKU | The power cut that saved Maersk, and what NotPetya teaches about Ac...