{"id":"CMP-202611-vyahqz","kind":"campaign","aliases":[],"related":[],"title":"Maersk confirms data breach of a legacy LF Logistics system; WhiteArmor ransomware gang claims 100 GB stolen and demands $5 million","description":null,"summary":"Shipping group A.P. Moller-Maersk confirmed on 11 Nov 2026 that a threat actor got into a local legacy system inherited through an earlier acquisition and took data from it. The WhiteArmor ransomware gang listed Maersk on its leak site over the weekend of 7-8 Nov 2026 and demands USD 5 million in bitcoin within 30 days. The gang says it holds about 100 GB from the OCF/LF Logistics contract-logistics platform (LF Logistics, bought from Li & Fung in 2022). It claims this includes records of nearly 30,000 drivers, plaintext passwords, 33 SUPER_ADMIN accounts, signed delivery receipts, inventory rows with purchase orders and Advance Shipping Notices, and 27,842 mobile device logs with phone numbers, emails and IMEI numbers. Maersk has not confirmed these claims. It says current evidence shows no sensitive data was disclosed, operations are not disrupted, and nothing shows that other Maersk systems or customer and partner API/EDI integrations were affected. When the intrusion happened and how the attackers got in are unknown (BleepingComputer).","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Maersk Contract Logistics (OCF/LF Logistics platform)","fixed":[],"ecosystem":"service"},{"name":"A.P. Moller-Maersk","note":"disclosed by the company","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Check whether your company, or drivers and staff working for it, used Maersk contract logistics (formerly LF Logistics) or its OCF/LF Logistics platform for fulfilment, warehousing or deliveries. If so, the gang claims it has accounts with plaintext passwords, driver records and mobile device details (phone numbers, emails, IMEI) from that platform. Treat any unexpected message that claims to be about the Maersk incident as suspect. No sender domains, lure text or technical indicators have been published.","fix":"If you or your staff had logins on the OCF/LF Logistics platform, change those passwords and any other account that uses the same password, and turn on MFA wherever you can. Warn drivers and logistics staff about phishing and SMS scams that use Maersk or LF Logistics shipment details. Check any message about the incident through your usual Maersk contact, as Maersk advises. Watch for notices from Maersk.","status":"open","published_at":null,"first_seen_at":"2026-11-11T16:43:07+00:00","triaged_at":"2026-11-11T16:43:07+00:00","updated_at":"2026-11-11T16:52:54+00:00","category":"vendor","confidence":null,"triage":{"cause":{"at":"2026-11-11T16:54:46Z","path":"unknown","entry":"unknown","reason":"The record states that how the attackers got in is unknown, and it does not say how the incident reached users, customers or dependents beyond the gang's unverified claim to hold their data.","history":[{"at":"2026-11-11T16:44:40Z","path":"third-party-breach","entry":"unknown","confidence":0.7}],"confidence":0.8}},"analyst_status":"done","analyst_note":null,"search":"'-202611':23A '-8':85B '000':130B '100':15A,104B '11':47B '2022':121B '2026':49B,87B '27':151B '30':96B,129B '33':134B '5':20A,91B '7':84B '842':152B 'a.p':31A,41B 'account':137B 'acquisit':64B 'actor':53B 'admin':136B 'advanc':147B 'affect':197B 'api/edi':194B 'attack':205B 'bitcoin':94B 'bleepingcomput':210B 'bought':116B 'breach':4A 'campaign':35B 'claim':14A,123B,168B 'cmp':22A 'confirm':2A,45B,166B 'contract':26A,111B 'contract-logist':110B 'current':171B 'custom':191B 'data':3A,67B,176B 'day':97B 'deliveri':139B 'demand':19A,89B 'devic':154B 'disclos':178B 'disrupt':182B 'driver':131B 'earli':37B 'earlier':63B 'early-warn':36B 'email':159B 'evid':172B 'fung':119B 'gang':13A,73B,99B 'gb':16A,105B 'got':54B,206B 'group':40B 'happen':201B 'hold':102B 'imei':161B 'includ':125B 'inherit':60B 'integr':195B 'intrus':200B 'inventori':141B 'leak':78B 'legaci':7A,58B 'lf':8A,114B 'li':118B 'list':74B 'local':57B 'log':155B 'logist':9A,109B,112B,115B 'logistics':27A,29A 'maersk':1A,25A,34A,44B,75B,163B,188B 'million':21A,92B 'mobil':153B 'moller':33A,43B 'moller-maersk':32A,42B 'near':128B 'noth':184B 'notic':149B 'nov':48B,86B 'number':158B,162B 'ocf/lf':28A,108B 'oper':179B 'order':145B 'partner':193B 'password':133B 'phone':157B 'plaintext':132B 'platform':30A,113B 'purchas':144B 'ransomwar':12A,72B 'receipt':140B 'record':126B 'row':142B 'say':100B,170B 'sensit':175B 'ship':39B,148B 'show':173B,185B 'sign':138B 'site':79B 'stolen':17A 'super':135B 'system':10A,59B,189B 'threat':52B 'took':66B 'unknown':209B 'usd':90B 'vyahqz':24A 'warn':38B 'weekend':82B 'whitearmor':11A,71B 'within':95B","nicknames":["Maersk breach","WhiteArmor"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["apmollermaersk","contractlogisticsocflflogisticsplatform","maerskbreach","maerskcontractlogisticsocflflogisticsplatform","mollermaersk","whitearmor"],"ptokens":["contract","lf","logistics","maersk","moller","ocf","platform"],"labels":["campaign","earlywarning","medium","vendor"],"campaign_type":"breach","search_a":"'-202611':23A '100':15A '5':20A 'a.p':31A 'breach':4A 'claim':14A 'cmp':22A 'confirm':2A 'contract':26A 'data':3A 'demand':19A 'gang':13A 'gb':16A 'legaci':7A 'lf':8A 'logist':9A 'logistics':27A,29A 'maersk':1A,25A,34A 'million':21A 'moller':33A 'moller-maersk':32A 'ocf/lf':28A 'platform':30A 'ransomwar':12A 'stolen':17A 'system':10A 'vyahqz':24A 'whitearmor':11A","search_b":"'-8':85B '000':130B '100':104B '11':47B '2022':121B '2026':49B,87B '27':151B '30':96B,129B '33':134B '5':91B '7':84B '842':152B 'a.p':41B 'account':137B 'acquisit':64B 'actor':53B 'admin':136B 'advanc':147B 'affect':197B 'api/edi':194B 'attack':205B 'bitcoin':94B 'bleepingcomput':210B 'bought':116B 'campaign':35B 'claim':123B,168B 'confirm':45B,166B 'contract':111B 'contract-logist':110B 'current':171B 'custom':191B 'data':67B,176B 'day':97B 'deliveri':139B 'demand':89B 'devic':154B 'disclos':178B 'disrupt':182B 'driver':131B 'earli':37B 'earlier':63B 'early-warn':36B 'email':159B 'evid':172B 'fung':119B 'gang':73B,99B 'gb':105B 'got':54B,206B 'group':40B 'happen':201B 'hold':102B 'imei':161B 'includ':125B 'inherit':60B 'integr':195B 'intrus':200B 'inventori':141B 'leak':78B 'legaci':58B 'lf':114B 'li':118B 'list':74B 'local':57B 'log':155B 'logist':109B,112B,115B 'maersk':44B,75B,163B,188B 'million':92B 'mobil':153B 'moller':43B 'moller-maersk':42B 'near':128B 'noth':184B 'notic':149B 'nov':48B,86B 'number':158B,162B 'ocf/lf':108B 'oper':179B 'order':145B 'partner':193B 'password':133B 'phone':157B 'plaintext':132B 'platform':113B 'purchas':144B 'ransomwar':72B 'receipt':140B 'record':126B 'row':142B 'say':100B,170B 'sensit':175B 'ship':39B,148B 'show':173B,185B 'sign':138B 'site':79B 'super':135B 'system':59B,189B 'threat':52B 'took':66B 'unknown':209B 'usd':90B 'warn':38B 'weekend':82B 'whitearmor':71B 'within':95B","search_c":"","cause_entry":"unknown","cause_path":"unknown","disclosures_checked_at":"2026-11-11T16:53:06+00:00","first_public_at":"2026-11-11T16:24:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-vyahqz","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-11T16:43:07+00:00","fetched_at":"2026-11-11T16:43:07+00:00","note":null}],"documents":[{"id":126885,"url":"https://x.com/BleepinComputer/status/2120553281248194611","title":"@BleepinComputer: Maersk confirms data breach as WhiteArmor ransomware demands $5 million\nhttps://","kind":"post","source":"x","publisher":null,"text":"Maersk confirms data breach as WhiteArmor ransomware demands $5 million\nhttps://t.co/Spvglci20m\n\nhttps://t.co/Spvglci20m\n\nlikes 13 reposts 3","published_at":"2026-11-11T16:24:34+00:00","relation":"describes","confidence":null,"note":null},{"id":126915,"url":"https://www.bleepingcomputer.com/news/security/maersk-confirms-data-breach-as-whitearmor-ransomware-demands-5-million/","title":"BleepingComputer: Maersk confirms data breach as WhiteArmor ransomware demands $5 million","kind":"blog","source":"blog","publisher":null,"text":"Maersk confirms data breach as WhiteArmor ransomware demands $5 million\n\nMaersk announced that a threat actor gained unauthorized access to a local legacy system inherited through an earlier acquisition and extracted data from it. [...]","published_at":"2026-11-11T16:24:18+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[{"company":"A.P. Moller-Maersk","domain":"maersk.com","url":"https://www.maersk.com/news/articles/2026/11/11/it-security-incident","kind":"blog","published_at":"2026-11-11T00:00:00+00:00","quote":"A.P. Moller – Maersk has identified an IT security incident involving unauthorised access and data extraction from one of our local legacy systems from a previous acquisition.","confidence":0.949999988079071,"source":"model","created_at":"2026-11-11T16:52:54+00:00","entry":"unknown"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}