---
id: "CMP-202611-vyahqz"
page: "https://infrastack.ai/live/CMP-202611-vyahqz"
kind: "campaign"
aliases: []
title: "Maersk confirms data breach of a legacy LF Logistics system; WhiteArmor ransomware gang claims 100 GB stolen and demands $5 million"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Maersk Contract Logistics (OCF/LF Logistics platform)", "fixed": [], "ecosystem": "service"}, {"name": "A.P. Moller-Maersk", "note": "disclosed by the company", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-11T16:43:07+00:00"
updated_at: "2026-11-11T16:52:54+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-11T16:43:07+00:00"}]
exploit_sources: []
---

# Maersk confirms data breach of a legacy LF Logistics system; WhiteArmor ransomware gang claims 100 GB stolen and demands $5 million

Link for people: https://infrastack.ai/live/CMP-202611-vyahqz (this .md is for agents)

Shipping group A.P. Moller-Maersk confirmed on 11 Nov 2026 that a threat actor got into a local legacy system inherited through an earlier acquisition and took data from it. The WhiteArmor ransomware gang listed Maersk on its leak site over the weekend of 7-8 Nov 2026 and demands USD 5 million in bitcoin within 30 days. The gang says it holds about 100 GB from the OCF/LF Logistics contract-logistics platform (LF Logistics, bought from Li & Fung in 2022). It claims this includes records of nearly 30,000 drivers, plaintext passwords, 33 SUPER_ADMIN accounts, signed delivery receipts, inventory rows with purchase orders and Advance Shipping Notices, and 27,842 mobile device logs with phone numbers, emails and IMEI numbers. Maersk has not confirmed these claims. It says current evidence shows no sensitive data was disclosed, operations are not disrupted, and nothing shows that other Maersk systems or customer and partner API/EDI integrations were affected. When the intrusion happened and how the attackers got in are unknown (BleepingComputer).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- service:Maersk Contract Logistics (OCF/LF Logistics platform) affected range not listed fixed no fixed version listed
- vendor:A.P. Moller-Maersk affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record states that how the attackers got in is unknown, and it does not say how the incident reached users, customers or dependents beyond the gang's unverified claim to hold their data.

How it reached others: not stated (unknown).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#unknown

## How to check

Check whether your company, or drivers and staff working for it, used Maersk contract logistics (formerly LF Logistics) or its OCF/LF Logistics platform for fulfilment, warehousing or deliveries. If so, the gang claims it has accounts with plaintext passwords, driver records and mobile device details (phone numbers, emails, IMEI) from that platform. Treat any unexpected message that claims to be about the Maersk incident as suspect. No sender domains, lure text or technical indicators have been published.

## Fix

If you or your staff had logins on the OCF/LF Logistics platform, change those passwords and any other account that uses the same password, and turn on MFA wherever you can. Warn drivers and logistics staff about phishing and SMS scams that use Maersk or LF Logistics shipment details. Check any message about the incident through your usual Maersk contact, as Maersk advises. Watch for notices from Maersk.

## Timeline

- 2026-11-11T00:00:00+00:00 confirmed by A.P. Moller-Maersk (blog) https://www.maersk.com/news/articles/2026/11/11/it-security-incident "A.P. Moller – Maersk has identified an IT security incident involving unauthorised access and data extraction from one of our local legacy systems from a previous acquisition."
- 2026-11-11T16:43:07+00:00 analyst

## Documents

- [describes] @BleepinComputer: Maersk confirms data breach as WhiteArmor ransomware demands $5 million
https:// https://x.com/BleepinComputer/status/2120553281248194611
- [describes] BleepingComputer: Maersk confirms data breach as WhiteArmor ransomware demands $5 million https://www.bleepingcomputer.com/news/security/maersk-confirms-data-breach-as-whitearmor-ransomware-demands-5-million/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_