A.P. Moller – Maersk is investigating a cybersecurity incident after detecting unauthorised access and data extraction from a local legacy IT system inherited through a previous acquisition. The breach reportedly occurred over the weekend of 7–8 November 2026. Maersk publicly disclosed the incident in an official security advisory published on 11 November 2026.
In its IT security incident advisory, Maersk said its Cyber Security team launched a full investigation immediately after discovering the issue and took swift action to secure the affected system. The investigation remains ongoing.
Maersk said its findings so far strongly suggest that no sensitive data has been disclosed. The incident is isolated to a local system.
... and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI.
Importantly for customers, Maersk currently does not anticipate any operational disruption. Its digital platforms remain available, allowing customers to continue booking and managing shipments as usual. The company said it will keep customers informed as its investigation progresses and will contact affected parties if further findings make this necessary.
Reports link incident to ransomware claims
Seatrade Maritime reported on 12 November that ransomware group WhiteArmor had claimed responsibility for breaching Maersk's cyber defences.
According to the report, the group claims to have obtained around 100 GB of data, including more than 29,000 driver records, over 16,000 staff accounts, as well as invoices, receipts, mobile numbers and email addresses. The group is reportedly demanding USD 5 million in bitcoin.
Splash247 reported that the alleged data theft involved a platform associated with LF Logistics, the Hong Kong-based logistics company acquired by Maersk in 2022.
However, the publication stressed that the ransomware group's claims remain unverified and that Maersk has not confirmed any connection between those claims and the security incident currently under investigation.
Maersk's own statement does not identify the acquired business connected to the affected legacy system, disclose what information was extracted or name the party responsible for the intrusion.
No impact on cargo operations reported
For Sea Logistics customers, the key point at this stage is that no disruption to Maersk's operational or customer-facing shipping systems has been reported.
Booking and shipment-management services continue to operate normally, while Maersk has found no indication that API or EDI connections with customers and partners have been affected.
Maersk is also advising customers to remain cautious about unexpected communications claiming to relate to the incident and to verify suspicious messages through their usual Maersk contacts.
