MAERSK has confirmed it has been the victim of a cyber attack, after a little-known hacker group said that it has extracted 100 GB of information from the Danish boxship giant’s logistics operations.
The world’s second-largest container shipping company was forced offline for over a week nine years ago, after its systems were infiltrated by destructive wiper malware.
Things look less serious this time around, with no disruption to operations for customers anticipated. Client-facing platforms are available to book and manage shipments as usual, Maersk said in a statement on its website.
The statement confirmed that Maersk had identified unauthorised access and data extraction from one of the local legacy systems resulting from a previous acquisition.
A full investigation was immediately launched, which remained ongoing at the time of writing, and the company said it had taken swift action to secure the affected system.
“Our findings so far strongly suggest no sensitive data has been disclosed,” it added.
“The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs [application programming interfaces] and EDI [electronic data interchange].”
Maersk emphasised that it takes cyber security and data protection very seriously and pledged to keep customers informed about the incident.
The statement named neither the date on which the cyber attack took place nor the system involved.
Dark web threat claim
Four days ago, the RecentBreaches website — an automated data scraper that scours the dark web for threat claims — listed a post from hacker group WhiteArmor, which said that it had stolen operational information from Hong Kong-based logistics provider LF Logistics, acquired by Maersk in 2022.
This was said to include 29,297 driver profiles, of which 16,093 include plaintext passwords, alongside 16,123 employee accounts, including 33 with elevated administrative privileges.
The dataset also purportedly contained information on 19,000 delivery recipients, more than 64,000 signed delivery receipts, over 14m warehouse inventory records and hundreds of thousands of purchase orders and shipment notifications.
WhiteArmor — which offers to reward company insiders with access to internal systems — said it would publish the information unless it receives $5m in bitcoin by December 7.
While RecentBreaches is regarded as a serious tool for cyber security professionals, by its nature it often republishes unverified third-party claims by criminals.
Lloyd’s List asked Maersk whether reports that had been subject to an extortion threat by WhiteArmor were credible. A spokesperson replied: “We cannot provide additional comments about the incident. But I can say that the two mentioned incidents in your email are connected.”
NotPetya worm
Maersk previously experienced a major systems outage in June 2017 after NotPetya — an example of what IT specialists refer to as a “worm” rather than a virus — spread across its global IT network in just seven minutes via a compromised Ukrainian accounting software update.
The attack destroyed about 49,000 laptops and up to 7,000 servers, and rendered over 1,000 applications inaccessible.
Some 17 of Maersk’s 76 port terminals worldwide, including key hubs, were completely shut down or severely constrained, disrupting global supply chains.
The firm was left with no alternative but to switch to manual, paper-driven processes, causing a 20% drop in trading volumes.
Almost all of Maersk’s domain controllers and online backups were encrypted or wiped, with recovery only possible because a single domain controller in Ghana was offline at the exact moment of the attack due to a local power outage.
Core online booking and operational systems were mostly restored within eight to 10 days, though full network restoration took around four weeks
At a conservative estimate, direct losses to Maersk ran to somewhere between $250m-$300m.
