Maersk has confirmed that an attacker accessed a local legacy system inherited through an earlier acquisition and extracted data. In a November 11 advisory, the shipping group said it had launched an investigation and was taking action to secure the affected system.
The company said its findings so far suggest that sensitive data has not been disclosed. It reported no indication of impact on other Maersk systems or on customer and partner systems connected through APIs or electronic data interchange. Those findings remain preliminary while the investigation continues.
The disclosure follows an extortion claim by WhiteArmor. BleepingComputer reported that the group demanded $5 million and claimed to have taken approximately 100GB from the OCF/LF Logistics platform. The claimed volume and contents have not been confirmed by Maersk.
Maersk does not expect operational disruption and said customers can continue booking and managing shipments through its platforms. Its notice did not identify the initial access method or specify which types of records were extracted.
For customers and partners, the immediate guidance is to verify unexpected messages about the incident through an established Maersk contact. The company said it would provide further updates and notify affected parties if its investigation identifies a need to do so.
