Maersk Investigates Ransomware Claim by New Group WhiteArmor
Shipping giant Maersk is probing a ransomware attack claim by WhiteArmor, which alleges the theft of 100GB of data from a legacy system and demands a $5 million ransom.
Global shipping conglomerate A.P. Moller-Maersk is currently investigating a claim by a newly emerged ransomware and data extortion group known as WhiteArmor. The group alleges it has exfiltrated approximately 100 gigabytes of data from a legacy IT system within Maersk, reportedly inherited from a previous acquisition.
WhiteArmor, which has been active since late October, claims to have obtained sensitive information including driver records, staff accounts, delivery recipient details, and mobile device logs. The group is demanding a ransom of $5 million in Bitcoin, threatening to publish the stolen data if the payment is not made within 30 days. Maersk has stated that its internal investigation, as of Wednesday, has not confirmed any theft of sensitive data or any operational disruptions.
The alleged target system is described by WhiteArmor as belonging to Maersk's contract-logistics arm, formerly known as LF Logistics. The group justified its ransom demand by stating that the value of the stolen data is roughly equivalent to four hours of the division's earnings before interest, taxes, depreciation, and amortization (EBITDA). Maersk, one of the world's largest container shipping companies, operates over 700 vessels and serves more than 100,000 customers globally.
Maersk has emphasized that the incident appears to be contained within a "local system" and does not affect other company systems or those of its partners. The company has assured customers that they can continue to use Maersk platforms for booking and managing shipments without interruption. This statement aims to mitigate concerns about widespread operational impact, drawing a contrast with past incidents.
WhiteArmor has a history of targeting various organizations, claiming attacks against over 20 entities worldwide, including logistics firms, retailers, and manufacturers. The group previously claimed a data breach affecting freight shipper J.B. Hunt, which subsequently led to a class-action lawsuit. The group's aggressive tactics and rapid emergence highlight the evolving threat landscape posed by new ransomware actors.
This incident brings to mind Maersk's significant experience with the NotPetya ransomware attack in 2017, which crippled its network for ten days and resulted in an estimated $300 million in costs for recovery and system replacement. While the current incident is reportedly contained, the company's past vulnerability underscores the persistent risks associated with large-scale IT infrastructure.
As the investigation continues, cybersecurity professionals will be closely monitoring the situation for any confirmed data exfiltration or operational impact. The emergence of WhiteArmor also adds another player to the growing list of ransomware groups actively targeting global businesses, emphasizing the need for robust cybersecurity defenses and rapid incident response capabilities.