Maersk Line, the Danish shipping giant, has confirmed a cyber security breach on an older system it acquired as part of its 2022 purchase of LF Logistics. The incident happened last weekend and was attributed to the ransomware group WhiteArmor.

The cybercriminal group is reportedly threatening to release about 100GB of allegedly stolen data from the OCF/LF Logistics platform. The data is said to have included over 29,000 driver records, over 16,000 employee accounts, invoices, receipts, mobile phone numbers and email addresses.

US-based cyber security magazine BleepingComputer also reported that WhiteArmor has logins for 33 high-level admin accounts.

The group is asking for $5 million in Bitcoin as ransom, to be paid within 30 days of the security breach.

Maersk, through a public relations firm, issued a statement to customers saying that no sensitive data had been released. The company also said it does not expect any disruption to its business.

This means customers can continue to manage their shipments via Maersk’s existing systems, without disruption.

Maersk further explained that the breach is limited to a local system and that the company’s investigations have not found any evidence of impact on other company platforms or on the systems of customers and partners connected via integration technologies such as APIs and Electronic Data Interchange (EDI).

"Legacy IT infrastructure can pose security risks, including vulnerabilities that have gone undetected," said Dray Agha, senior manager of tactical response at cybersecurity platform Huntress, commenting on the incident.

Agha also pointed to the success of Maersk’s network segmentation strategy, which limited the data theft to a local platform without disrupting the company’s primary shipping functions.