Maersk confirms data theft as WhiteArmor demands $5 million

Researchers for that report linked the breach to LF Logistics and said the platform mainly holds data from other logistics companies. They described the ability to manipulate customer accounts and create or delete orders through administrative accounts. That describes a potential consequence of privileged access; it does not establish that attackers changed orders or retained working access.

WhiteArmor has a recent record of targeting transport businesses. In a November 11 report on the group, Ben Wilkens, director of cybersecurity at the National Motor Freight Traffic Association, said it emerged in October and had targeted transportation companies ranging from large national fleets to smaller regional operators. That account does not establish how the attackers entered Maersk’s system. The reporting on this incident also does not establish that Maersk’s systems were encrypted.

Archival LF Logistics photograph from Maersk’s August 2022 acquisition announcement. It does not depict the affected IT system. Credit: Maersk. Source: Maersk.

An inherited system inside a larger logistics business

Maersk operates shipping, terminals, warehousing and land and air transport across roughly 130 countries. LF Logistics served retail, wholesale and e-commerce customers in Asia-Pacific.

Maersk’s August 31, 2022 acquisition announcement said the purchase would expand its ability to serve Asian consumer markets and fulfil orders across sales channels. Its Asian business had historically focused on ocean transport out of the region and related logistics services. Maersk said LF Logistics would be rebranded under its name.

The announcement valued the transaction at $3.6 billion in enterprise value after IFRS 16 lease liabilities. It said LF Logistics would add 223 warehouses, its total at the end of 2021, bringing Maersk’s global portfolio to 549 facilities. Those are acquisition-era figures, not a measure of the systems or customers affected by this breach.

The acquisition explains why a local logistics platform sits within a much larger shipping group. It does not establish how attackers entered, whether an integration failed, or whether the age of the system caused the compromise. Maersk has not publicly supplied that technical account.

The company also has a costly cyberattack precedent. It expected the destructive 2017 NotPetya attack to cost about $300 million. Jim Hagemann Snabe, Maersk’s chairman at the time, said in 2018 that recovery involved rebuilding 4,000 servers, 45,000 PCs and 2,500 applications over ten days, as recounted in the account of its recovery. That history explains the significance of operational containment, but the current disclosure offers no basis to equate the two incidents’ severity.

What the investigation still needs to establish

Maersk says it secured the affected local system and has found no indication of impact on its other systems or on customer and partner systems connected through application programming interfaces or electronic data interchange. It says customers can continue booking and managing shipments as usual.

Its assessment of disclosure remains provisional. In its statement reproduced in the incident report, Maersk said: “Our findings so far strongly suggest no sensitive data has been disclosed.” That assurance accompanies an ongoing investigation, rather than a complete public inventory of the extracted records.

The unresolved questions are which records were extracted, whose information they contain, when access occurred and whether the administrative-account claims are substantiated. Maersk’s account of expired codes addresses one disputed risk; it does not by itself resolve the claims about personal information and logistics documents.

Maersk says it will update customers as relevant information becomes available and notify affected parties if further findings require it. It also advises customers to verify unexpected messages about the incident through their usual Maersk contact. A clearer accounting of the extracted data will determine who needs to act despite the company’s assurance that shipments can continue.