Maersk logistics platform breach leads to 100GB data theft and $5 million ransom
TL;DR
The WhiteArmor ransomware group has targeted Maersk, demanding a $5 million bitcoin payment following a breach of a legacy logistics platform. The attackers claim to have stolen 100GB of data, including highly privileged administrator accounts and driver records.
What happened
Maersk confirmed that a threat actor breached a local system belonging to its OCF/LF Logistics platform, a company it acquired in 2022. The WhiteArmor ransomware group listed Maersk on its data leak site over the weekend, demanding $5,000,000 in bitcoin.
WhiteArmor claims the exfiltrated 100GB of data contains 33 SUPER_ADMIN accounts with plaintext passwords, nearly 30,000 driver records, signed delivery receipts, and 27,842 mobile device logs containing phone numbers, emails, and IMEI numbers. Maersk stated the incident is isolated to a local system and that current evidence indicates no sensitive data has been disclosed or impact to other Maersk systems, APIs, or EDI integrations.
Why it matters
This is a high-stakes extortion attempt against a critical piece of global shipping infrastructure. If the threat actor's claims regarding the SUPER_ADMIN accounts and plaintext passwords are accurate, the attackers could have deep, privileged access to the logistics platform's management functions. The theft of thousands of mobile device logs and driver records presents a significant secondary risk of identity theft and targeted phishing against the company's workforce and partners.
Who is affected
- Maersk (specifically the OCF/LF Logistics platform)
What to do now
- Monitor for unauthorized access or suspicious activity involving highly privileged
SUPER_ADMINaccounts. - Treat any unexpected communications claiming to relate to this matter with extreme caution.
- Verify all unexpected communications through established Maersk contact channels.
- Watch for potential phishing or credential abuse targeting drivers and logistics personnel.
What we don't know yet
- The specific root cause or entry point of the intrusion.
- The exact date the intrusion occurred.
- The specific types of sensitive data contained within the 100GB of exfiltrated information.
- Whether the stolen data has been released or if the $5 million demand is met.
Sources
