Maersk, a leader in global shipping and logistics, has disclosed a data breach involving one of its IT systems. The breach was revealed after an extortion group, known as WhiteArmor, claimed to have stolen 100GB of logistics-related data from the company. In a statement on November 11, Maersk confirmed unauthorized access and data extraction from a local legacy system acquired through a previous acquisition. The company assured stakeholders that no sensitive data appears to have been disclosed and that the incident is isolated to this local system. Operations for customers remain unaffected, allowing them to continue using Maersk platforms as usual.
Industry experts have weighed in on the breach, highlighting challenges related to mergers and acquisitions. Seemant Sehgal, founder and CEO of BreachLock, emphasized the importance of conducting penetration tests during due diligence to identify potential vulnerabilities in acquired systems. Darin Fredde of Ridge Security added that organizations should not only replace legacy systems but also understand how these systems connect to the broader business and continuously validate their security controls.
The extortion group WhiteArmor has demanded $5 million in Bitcoin for the stolen data, which reportedly includes sensitive information such as driver records, plaintext passwords, staff accounts, and mobile device logs. According to Nick Harris, CISO at Assured, WhiteArmor has been active in the logistics sector, targeting companies like J.B. Hunt and Ryder, and is planning to expand into ransomware activities.
This breach is the most significant cyber incident Maersk has faced since the NotPetya attack in 2017, which resulted in substantial financial losses. The company is now focused on managing the fallout from this breach and ensuring robust security measures are in place to prevent future incidents.
