Global shipping and logistics giant A.P. Moller-Maersk has confirmed that it recently suffered a cyberattack resulting in the theft of sensitive data from a legacy system belonging to an earlier corporate acquisition. The intrusion specifically targeted the infrastructure of LF Logistics, an independent Hong Kong-based third-party warehousing and ecommerce fulfillment firm that Maersk acquired in 2022 for $3.6 billion and subsequently integrated into its global Logistics & Services division. While the shipping conglomerate asserts that its core operations remain unaffected, a ransomware syndicate has publicly claimed responsibility and initiated a multi-million-dollar extortion campaign.
Key takeaways
- Hackers claim to have stolen 100GB of data from a legacy system tied to the acquired firm LF Logistics.
- The threat group WhiteArmor is demanding a $5 million ransom paid in bitcoin within 30 days.
- Maersk maintains that core operations, customer connections, and partner APIs remain completely unaffected.
- Reported stolen records include nearly 30,000 driver records, plaintext passwords, and mobile device logs.
Details of the WhiteArmor Extortion Demand
The threat group operating under the name WhiteArmor has added Maersk to its dark web data leak site, establishing a strict 30-day deadline for the payment. According to the attackers, the targeted contract-logistics arm handles fulfillment operations for numerous major consumer brands across the globe. The $5 million bitcoin demand is reportedly calculated to equal roughly four hours of EBITDA for that specific division. The cybercriminals have threatened to release all acquired records, passwords, and underlying logistics information publicly if the corporate entity fails to comply.
Maersk issued an official incident report addressing the breach, noting that findings strongly suggest no sensitive information has been disclosed externally thus far. Company representatives emphasized that the malicious activity was isolated to a local system. Furthermore, management has found no indication that customer or partner systems connecting to Maersk via integrations like application programming interfaces or electronic data interchange have suffered any disruption. Consequently, the enterprise has instructed customers to continue booking and managing shipments through normal platform channels.
Scope of the Stolen Data and Enterprise Risk
Despite the company's assurances regarding operational continuity, the nature of the pilfered database presents notable security hurdles. WhiteArmor claims to have successfully exfiltrated 100 gigabytes of files, encompassing approximately 30,000 driver records, plaintext passwords, 33 super administrator accounts, signed delivery receipts, and 14.44 million inventory rows detailing purchase orders and advance shipping notices. In addition, the hackers report obtaining 27,842 mobile device logs featuring telephone numbers, email addresses, and international mobile equipment identity numbers.
The inclusion of plaintext passwords and privileged administrative accounts requires internal IT teams to execute a comprehensive rotation of system credentials to safeguard infrastructure. Security analysts note that exposed phone numbers and unique device identifiers leave individuals vulnerable to targeted phishing and vishing operations. For an enterprise employing over 100,000 people and managing more than 60 terminals alongside 500 warehousing facilities worldwide, the incident recalls previous historical challenges. Back in 2017, the destructive NotPetya cyberattack brought the shipping company's global network to a standstill, causing damages estimated between $250 million and $300 million.
Comments