An acquisition can leave a company managing inherited systems for years. Maersk’s latest breach shows why their security still matters.
A.P. Moller-Maersk confirmed on Nov. 11 that attackers gained unauthorized access to a local legacy IT system inherited through a previous acquisition and extracted data. The Danish shipping and logistics company said it does not anticipate disruption to customer operations.
The investigation leaves two questions for customers and security teams: what information was taken, and whether the affected system’s connections exposed anything else.
In its incident advisory, Maersk said its cybersecurity team launched an investigation and took immediate steps to secure the affected system.
The company said its preliminary findings strongly suggest that no sensitive data has been disclosed. It also reported no indication of impact on other Maersk systems or customer and partner systems connected through application programming interfaces (APIs) and electronic data interchange (EDI).
Maersk has not disclosed when the intrusion occurred or identified the specific system involved in its advisory.
WhiteArmor demands $5 million after alleged data theft
The disclosure follows claims by ransomware group WhiteArmor, which listed Maersk on its leak site and threatened to publish approximately 100GB of allegedly stolen information unless the company paid $5 million in bitcoin within 30 days.
According to BleepingComputer, the group claims the stolen material includes driver records, administrator accounts, delivery receipts, inventory information and mobile device logs.
WhiteArmor wants $5 million. Image: BleepingComputer
Maersk confirmed to Cybernews that its advisory concerns the incident claimed by WhiteArmor. The company disputed the group’s plaintext-password allegation, saying passwords were stored in protected form and the stolen single-use codes had expired.
WhiteArmor linked its allegations to LF Logistics, which Maersk acquired from Li & Fung and Temasek in 2022 in a transaction valued at $3.6 billion. Maersk’s advisory does not identify the acquired business or confirm the group’s claimed data inventory.
The current findings differ from Maersk’s NotPetya crisis
The incident recalls June 2017, when the destructive NotPetya malware crippled Maersk’s IT infrastructure.
Maersk’s then-chairman Jim Hagemann Snabe said the company reinstalled approximately 4,000 servers, 45,000 computers and 2,500 applications over ten days. He estimated the damage at $250 million to $300 million.
The current disclosure describes unauthorized access and data extraction from a local legacy system, with no anticipated disruption to customer operations. It does not establish that attackers encrypted systems, as occurs in double-extortion ransomware attacks, or caused damage comparable to NotPetya.
Darin Fredde, senior director and offensive security evangelist at Ridge Security, said Maersk’s preliminary findings are encouraging, but unauthorized access and data extraction still warrant investigation.
“The important questions are what the attackers accessed, how they gained entry, and whether the boundaries separating that legacy environment from other systems held,” Fredde said.
Inherited systems need clear ownership and tested boundaries
For companies expanding through acquisitions, the security work extends beyond patching vulnerabilities. Teams also need to establish who owns inherited systems, which credentials remain active and what those systems can reach.
Seemant Sehgal, founder and CEO at BreachLock, said acquired environments can bring separate credentials, patch schedules and network connections that receive little attention after integration.
“Ownership of these systems often gets blurred during acquisitions, so any company that grew through acquisitions should know how many of these systems it inherited and what each one can still reach,” Sehgal said.
He recommended penetration testing during due diligence, while the buyer still has leverage to address problems before the deal closes.
Fredde’s emphasis was on understanding inherited technology and continuously validating its protections, rather than assuming every legacy application must immediately be replaced.
For security leaders, those observations translate into concrete checks:
- Assign ownership: Name a business owner and technical administrator for each inherited system, with clear responsibility for security reviews, patching and decisions about continued use.
- Map access: Review credentials and connections to the parent company, customers and partners, including whether each connection is still necessary.
- Validate boundaries: Test whether a compromised legacy environment could provide access to other systems.
- Revisit the assessment: Continue checking access and controls as integration changes how the system connects to the business.
“An acquisition may close financially in a few months. The security obligations can last decades,” Fredde said.
What Maersk’s customers should watch for
Maersk says customers can continue booking and managing shipments through its platforms as usual. However, the absence of reported operational disruption does not automatically settle questions about data exposure.
Customers should:
- Watch for unexpected emails or messages claiming to concern the incident.
- Verify unusual requests through established Maersk representatives.
- Monitor relevant accounts for suspicious activity.
- Follow Maersk’s updates for information about potentially affected records.
For businesses relying on Maersk’s logistics network, the immediate issue is whether information taken from the compromised environment could create downstream security or privacy risks, even while shipments continue normally.
Until the investigation establishes exactly what was accessed and extracted, customers should treat WhiteArmor’s claims as allegations and Maersk’s assessment as preliminary.
Read more: For another example of how connected business systems can complicate breach investigations, MS&AD’s recent disclosures span a third-party provider and a separate business portal.