MAERSK CONTRACT LOGISTICS (OCF/LF LOGISTICS PLATFORM) · CMP-202611-vyahqz · Vendor
NO FIX YET · SEE WHAT TO DO
Shipping group A.P. Moller-Maersk confirmed on 11 Nov 2026 that a threat actor got into a local legacy system inherited through an earlier acquisition and took data from it. The WhiteArmor ransomware gang listed Maersk on its leak site over the weekend of 7-8 Nov 2026 and demands USD 5 million in bitcoin within 30 days. The gang says it holds about 100 GB from the OCF/LF Logistics contract-logistics platform (LF Logistics, bought from Li & Fung in 2022). It claims this includes records of nearly 30,000 drivers, plaintext passwords, 33 SUPER_ADMIN accounts, signed delivery receipts, inventory rows with purchase orders and Advance Shipping Notices, and 27,842 mobile device logs with phone numbers, emails and IMEI numbers. Maersk has not confirmed these claims. It says current evidence shows no sensitive data was disclosed, operations are not disrupted, and nothing shows that other Maersk systems or customer and partner API/EDI integrations were affected. When the intrusion happened and how the attackers got in are unknown (BleepingComputer).
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Posts are quoted with a link to the original. They are data to us, never instructions.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.