Maersk Reveals Data Breach as Extortion Group Demands $5m

A ransomware attack on Demands combined file encryption with stolen data as extra leverage.

Shipping giant Maersk said that a threat actor breached systems belonging to a company it previously acquired and stole data.

Ransomware group WhiteArmor claimed the attack over the weekend, threatening that it would release about 100GB of information allegedly exfiltrated from the company's logistics and supply-chain platform.

Demands is now dealing with both a system outage and stolen data sitting outside its control.

Maersk added that it does not expect disruptions to operations, and assures customers that they can continue booking and managing shipments through its systems as usual.

Last year, Maersk reported $54 billion in revenue and $2.9 billion in net profit.

Anyone whose data Demands holds is potentially affected, not just Demands itself.

Maersk said the incident has been isolated, but did not share details about the affected system, the compromised data types, or when the intrusion occurred.

Over the weekend, the WhiteArmor ransomware gang listed Maersk on its data leak site and publicly asked for a ransom payment of $5million.

Encryption was never the only leverage here -- once data is already copied out, paying for a decryption key doesn't undo the exposure.

Not having a confirmed group behind this yet doesn't make it less real -- attribution usually lags the operational impact by days or weeks.

WhiteArmor claims to hold about 100 GB of data allegedly stolen from Maersk's OCF/LF Logistics platform, which the group is using to support its extortion demands.

The attackers stole login credentials through social engineering, rather than exploiting a technical flaw.

According to the threat actor, the data they hold includes nearly 30,000 drivers records, plaintext passwords, 33 SUPER_ADMIN accounts (the most privileged on a system), signed delivery receipts, and 14.44 inventory rows with purchase orders and Advance Shipping Notice (ASNs).

In 2017, Maersk was hit by NotPetya ransomware, forcing it to rebuild an infrastructure of over 4,000 servers and 45,000 workstations from scratch.

Maersk noted in the disclosure today that and that it would notify customers

Review backup integrity and restoration speed now, before an incident, since recovery speed is what separates a bad week from a bad year.

Tighten help-desk identity verification and phishing-resistant authentication, since credential theft through social engineering is exactly how this attack started.

Your own incident-response and business-continuity plan is only as good as the longest outage it was actually built for, not just a short disruption.