--- title: "Maersk confirms breach as WhiteArmor ransomware… | Firevault" url: https://fire-vault.com/news/maersk-whitearmor-data-breach-lf-logistics-2026 description: "Maersk has confirmed unauthorised access and data theft from a legacy system inherited through its 2022 acquisition of LF Logistics, after the WhiteArmor…" lang: en-GB --- Image: Illustration of a container port at night with a glowing network cable lying unplugged on the quayside, a container ship in the background (https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/maersk-whitearmor-lf-logistics-2026.jpg) Breaking News # Maersk confirms breach as WhiteArmor ransomware gang demands $5 million Maersk has confirmed unauthorised access and data theft from a legacy system inherited through its 2022 acquisition of LF Logistics, after the WhiteArmor ransomware group claimed to hold 100 GB of logistics data and demanded 5 million dollars in bitcoin. What is confirmed, what is claimed, and why inherited systems keep appearing in breach news. Image: Mark Fermor, CTO, CMO and Founder of Firevault (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) **Mark Fermor**CTO, CMO and Founder, Firevault Published 11 November 2026 · 6 min read Share LinkedIn (https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fmaersk-whitearmor-data-breach-lf-logistics-2026)Email ## What happened Maersk confirmed on 11 November 2026 that an unauthorised party accessed one of its older systems, inherited from a previous acquisition, and extracted data, BleepingComputer reported (https://www.bleepingcomputer.com/news/security/maersk-confirms-data-breach-as-whitearmor-ransomware-demands-5-million/). In its public statement (https://www.maersk.com/news/articles/2026/11/11/it-security-incident), the company says the incident is isolated to a local system, that it has found no indication of any impact on other Maersk systems or on the customer and partner systems that connect to Maersk through integrations such as APIs and EDI, and that it does not expect disruption to operations. The confirmation followed reporting by the Danish publication Ingeniøren (https://ing.dk/artikel/maersk-bekraefter-datalaek-efter-ingenioerens-afsloering-her-broed-hackerne-ind) that a ransomware group calling itself WhiteArmor had listed Maersk on its leak site on 7 November, claiming to hold around 100 GB of data and demanding 5 million US dollars in bitcoin, with a 30-day deadline. ## What WhiteArmor claims to hold According to the gang's leak-site post, as recorded by ransomware.live (https://www.ransomware.live/id/bWFlcnNrQFdoaXRlYXJtb3I) and reported by Container News (https://container-news.com/maersk-confirms-security-breach-amid-hacker-claims-of-major-data-theft/), the data allegedly taken from the OCF/LF Logistics platform includes: - 29,297 driver records, 16,093 of them with plaintext passwords; - 16,123 staff accounts, including 33 with the highest administrator privileges (SUPER_ADMIN); - 18,913 delivery recipients with names and street addresses; - 64,665 signed delivery receipts, 214,107 documents in total; - 14.44 million warehouse inventory rows, 189,248 purchase orders and 334,432 advance shipping notices; - 27,842 mobile device logs containing phone numbers, email addresses and IMEI device identifiers. None of these figures has been independently verified. Ransomware.live notes that WhiteArmor is a new group and that its claim should be treated with caution until it is. ## The system at the centre The platform named by the gang belongs to LF Logistics, the Hong Kong-based contract logistics business Maersk acquired from the Li & Fung Group in 2022. LF Logistics runs fulfilment and warehousing for large consumer brands. In its ransom note, WhiteArmor addressed Maersk directly: "Your contract-logistics arm, the former LF Logistics, runs fulfilment for many of the world's largest consumer brands. Five million dollars is roughly four hours of that EBITDA." Maersk has not named the affected system, the types of data involved or when the intrusion occurred. It says its investigation is ongoing and that current evidence indicates no sensitive data has been disclosed. That sits in tension with the gang's claims of plaintext passwords and personal details, and the gap between the two accounts is unlikely to close until the investigation concludes. ## Maersk has been here before In 2017 the NotPetya attack forced Maersk to rebuild more than 4,000 servers and 45,000 workstations from scratch, to operate without IT for ten days and to absorb damages of up to 300 million dollars, BleepingComputer reported at the time (https://www.bleepingcomputer.com/news/security/maersk-reinstalled-45-000-pcs-and-4-000-servers-to-recover-from-notpetya-attack/). This incident is different in kind: a claim of data theft and extortion against one acquired system, not a company-wide destructive attack. Maersk says bookings and shipment management continue as normal, and Lloyd's List reports (https://www.lloydslist.com/LL1158988/Maersk-cyber-attack-connected-to-hacking-group-claims-company-confirms) the company confirmed the incident is connected to the hacking group's claims. ## Why acquired and legacy systems keep appearing in breach news Every acquisition inherits the systems, accounts and passwords of the business being bought. Those systems were built for a smaller, simpler estate, and they are often connected to the new owner's network before anyone has mapped every account, integration and stored password they carry. An attacker who reaches a legacy system will test what else its connections can reach. The alleged contents of this dataset read like a checklist of what makes inherited systems dangerous: passwords stored in a readable form, dozens of top-level administrator accounts, and operational records covering drivers, recipients and stock. Every organisation that has acquired a business, or runs systems built before its current security standards, should ask: - **Which systems did we inherit, and do we know every account and password on them?** - **Which of our current systems can those legacy systems reach, and through which integrations?** - **Are passwords stored in a readable form anywhere, and who still holds administrator accounts?** - **Could we disconnect an inherited system from the rest of the estate in minutes if we had to?** ## Where Firevault fits Control by Firevault (https://fire-vault.com/control) applies just-in-time access to operational connections. Links between an inherited platform and the wider estate exist when approved work needs them and are physically disconnected the rest of the time, so a compromised legacy system has no standing path into everything else. Our Plans for controlling third-party access (https://fire-vault.com/control-plan/control-third-party-access), isolating the supply chain (https://fire-vault.com/control-plan/supply-chain-isolation) and interrupting data exfiltration (https://fire-vault.com/control-plan/data-exfiltration-interruption) set out how, and the Maritime Blueprint (https://fire-vault.com/control-blueprint/maritime) applies the same approach to shipping and port operations. Offline Secure Storage® (https://fire-vault.com/offline-secure-storage) keeps recovery copies on dedicated hardware that is physically disconnected and offline by default, so an attacker inside a connected system cannot reach the data needed to recover. Neither stops data being stolen from a system that must stay online to do its job, and neither replaces the unglamorous work of auditing inherited systems, removing plaintext passwords and closing unused accounts. The decision is which connections should exist at all when they are not in use. ## What to do now Based on the guidance Maersk has given its own customers and standard breach-response practice: - Treat any unexpected communication claiming to relate to this incident with caution and verify it through your usual Maersk contact, as the company advises. - If you drive for, deliver to or receive goods through LF Logistics services, watch for phishing that references deliveries, and change any password you have reused elsewhere. - If your organisation connects to Maersk through APIs or EDI, review which credentials and permissions those connections hold. - If you have recently acquired a business, audit its systems, accounts and password storage before you connect them to your estate. **Maersk says the incident is isolated. The lesson for everyone else is that inherited systems are part of your attack surface the day the deal signs, whether or not they appear on your own diagrams.** _Mark Fermor is CTO, CMO and Founder of Firevault. Explore Control by Firevault (https://fire-vault.com/control) or talk to the team (https://fire-vault.com/contact)._ ## Questions On 11 November 2026 Maersk confirmed that an unauthorised party accessed an older system inherited from a previous acquisition and extracted data. Maersk says the incident is isolated to a local system, that it has found no indication of impact on its other systems or on customer and partner connections through APIs and EDI, and that it does not expect disruption to operations. The WhiteArmor ransomware group claims to hold around 100 GB of data from the OCF/LF Logistics platform, including 29,297 driver records (16,093 with plaintext passwords), 16,123 staff accounts with 33 top-level administrator accounts, 18,913 delivery recipients with names and addresses, signed delivery receipts, 14.44 million inventory rows, purchase orders, advance shipping notices and mobile device logs. The figures come from the gang and have not been independently verified. LF Logistics is a Hong Kong-based contract logistics business that runs fulfilment and warehousing for large consumer brands. Maersk acquired it from the Li & Fung Group in 2022. The OCF/LF Logistics platform named in the ransom claim was originally developed by LF Logistics. There is no indication that Maersk has paid. WhiteArmor demanded 5 million US dollars in bitcoin within 30 days, a deadline that falls around 7 December 2026. Maersk says its investigation is ongoing and that current evidence indicates no sensitive data has been disclosed. Firevault has no connection to Maersk. Control by Firevault applies just-in-time access so that connections between inherited or legacy systems and the wider estate are physically disconnected when not needed, and Offline Secure Storage keeps recovery copies offline by default. Neither replaces auditing inherited systems, removing plaintext passwords or closing unused accounts. About the author **Mark Fermor** CTO, CMO and Founder of Firevault. Mark writes on physical control, offline storage and the incidents that show why both matter. ## More breach analysis - Breach Analysis · 11 Nov 2026**N-able takes N-central offline after 33 alleged zero-days are published**_Read the analysis_: https://fire-vault.com/news/n-able-n-central-able2shell-zero-days-2026 - Breach Analysis · 6 Nov 2026**GTA VI: When a Data Leak Becomes a Billion-Dollar Business Risk**_Read the analysis_: https://fire-vault.com/news/gta-vi-leak-billion-dollar-business-risk-2026 - Breach Analysis · 5 Nov 2026**French blood service cold rooms hit in freezer hacks as theories swirl about the culprits**_Read the analysis_: https://fire-vault.com/news/french-blood-service-freezer-hacks-2026 - Breach Analysis · 5 Nov 2026**Harvard breach: 851,000 email addresses linked to stolen alumni data**_Read the analysis_: https://fire-vault.com/news/harvard-alumni-data-breach-851000-email-addresses-2026 - Breach Analysis · 4 Nov 2026**Bristol school data breach: 320,000 files published on the dark web**_Read the analysis_: https://fire-vault.com/news/bristol-schools-320000-files-dark-web-2026 - Breach Analysis · 4 Nov 2026**Accenture confirms security incident after hacker claims 35GB data haul**_Read the analysis_: https://fire-vault.com/news/accenture-35gb-source-code-breach-2026 Back to the Knowledge Vault: https://fire-vault.com/learn/knowledge Image: Offline Secure Storage icon (https://fire-vault.com/__l5e/assets-v1/a78723d3-5b1a-48bf-9040-c767b759823d/oss-icon-correct.png) Why #OSS ### Keep a clean copy out of reach. Offline Secure Storage® keeps one copy physically disconnected at the hardware level between sessions. Why #OSS: https://fire-vault.com/why-oss Image: Control by Firevault icon (https://fire-vault.com/__l5e/assets-v1/9c97df8c-bca8-45bc-86f3-ec698db3afe8/control-icon.png) Control ### Govern the paths attackers depend on. Physical, out-of-band control of selected network paths, composed into Control Plans and industry Blueprints. Explore Control: https://fire-vault.com/control Image: Vault (https://fire-vault.com/__l5e/assets-v1/b9413e6e-5b45-442d-ab80-67cf0c578ba6/oss-approved-vault.png) Ready to start? ### Create your Vault online. Business Vaults from £360 a month inc VAT, on a 36-month commitment. Get started: https://fire-vault.com/get-started Book a demo: https://fire-vault.com/demo Get started ## Structured data ```json [ { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/maersk-whitearmor-data-breach-lf-logistics-2026#webpage", "url": "https://fire-vault.com/news/maersk-whitearmor-data-breach-lf-logistics-2026", "name": "Maersk confirms breach as WhiteArmor ransomware…", "description": "Maersk has confirmed unauthorised access and data theft from a legacy system inherited through its 2022 acquisition of LF Logistics, after the WhiteArmor…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/maersk-whitearmor-lf-logistics-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/maersk-whitearmor-data-breach-lf-logistics-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/maersk-whitearmor-data-breach-lf-logistics-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Maersk confirms breach as WhiteArmor ransomware gang demands $5 million", "item": "https://fire-vault.com/news/maersk-whitearmor-data-breach-lf-logistics-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Maersk confirms breach as WhiteArmor ransomware gang demands $5 million", "description": "Maersk has confirmed unauthorised access and data theft from a legacy system inherited through its 2022 acquisition of LF Logistics, after the WhiteArmor ransomware group claimed to hold 100 GB of logistics data and demanded 5 million dollars in bitcoin. What is confirmed, what is claimed, and why inherited systems keep appearing in breach news.", "url": "https://fire-vault.com/news/maersk-whitearmor-data-breach-lf-logistics-2026", "image": [ { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/maersk-whitearmor-lf-logistics-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/maersk-whitearmor-lf-logistics-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/maersk-whitearmor-lf-logistics-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/maersk-whitearmor-lf-logistics-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-11-11T18:16:47.132935+00:00", "dateModified": "2026-11-11T18:16:47.132935+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/maersk-whitearmor-data-breach-lf-logistics-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 1002, "keywords": "Maersk, Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "## What happened Maersk confirmed on 11 November 2026 that an unauthorised party accessed one of its older systems, inherited from a previous acquisition, and extracted data, [BleepingComputer reported](https://www.bleepingcomputer.com/news/security/maersk-confirms-data-breach-as-whitearmor-ransomware-demands-5-million/). In its [public statement](https://www.maersk.com/news/articles/2026/11/11/it", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What happened at Maersk?", "acceptedAnswer": { "@type": "Answer", "text": "On 11 November 2026 Maersk confirmed that an unauthorised party accessed an older system inherited from a previous acquisition and extracted data. Maersk says the incident is isolated to a local system, that it has found no indication of impact on its other systems or on customer and partner connections through APIs and EDI, and that it does not expect disruption to operations." } }, { "@type": "Question", "name": "What does WhiteArmor claim to have stolen?", "acceptedAnswer": { "@type": "Answer", "text": "The WhiteArmor ransomware group claims to hold around 100 GB of data from the OCF/LF Logistics platform, including 29,297 driver records (16,093 with plaintext passwords), 16,123 staff accounts with 33 top-level administrator accounts, 18,913 delivery recipients with names and addresses, signed delivery receipts, 14.44 million inventory rows, purchase orders, advance shipping notices and mobile device logs. The figures come from the gang and have not been independently verified." } }, { "@type": "Question", "name": "What is LF Logistics?", "acceptedAnswer": { "@type": "Answer", "text": "LF Logistics is a Hong Kong-based contract logistics business that runs fulfilment and warehousing for large consumer brands. Maersk acquired it from the Li & Fung Group in 2022. The OCF/LF Logistics platform named in the ransom claim was originally developed by LF Logistics." } }, { "@type": "Question", "name": "Has Maersk paid the ransom?", "acceptedAnswer": { "@type": "Answer", "text": "There is no indication that Maersk has paid. WhiteArmor demanded 5 million US dollars in bitcoin within 30 days, a deadline that falls around 7 December 2026. Maersk says its investigation is ongoing and that current evidence indicates no sensitive data has been disclosed." } }, { "@type": "Question", "name": "How does Firevault relate to this incident?", "acceptedAnswer": { "@type": "Answer", "text": "Firevault has no connection to Maersk. Control by Firevault applies just-in-time access so that connections between inherited or legacy systems and the wider estate are physically disconnected when not needed, and Offline Secure Storage keeps recovery copies offline by default. Neither replaces auditing inherited systems, removing plaintext passwords or closing unused accounts." } } ] }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } } ] ```