Maersk has disclosed a data breach involving one of its IT systems after an extortion group claimed to have stolen 100GB of logistics-related data from the company.
The shipping and logistics giant said in a November 11 statement that it “identified unauthorized access and data extraction,” although it didn’t clarify when.
The incident affected one of its “local legacy systems from a previous acquisition,” it claimed.
“Our findings so far strongly suggest no sensitive data has been disclosed. The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI [electronic data interchange],” the statement continued.
“We do not anticipate disruption to operations for customers at this time, and customers can continue to use Maersk platforms to book and manage their shipments as usual.”
Read more on Maersk: Cybersecurity Lessons from Maersk’s Former CISO
Seemant Sehgal, founder and CEO of BreachLock, explained that ownership of acquired systems often gets muddled during M&A activity, and pen tests should be carried out during due diligence to highlight any potential weaknesses.
“Acquired systems arrive with their own credentials, their own patch schedule, and connections into the parent network that were set up during integration and rarely revisited,” he added.
Darin Fredde, senior director and offensive security evangelist at Ridge Security, said that investigators must determine what the attackers accessed, how they gained entry, and whether the boundaries separating that legacy environment from other systems held.
“The lesson for organizations isn't simply to replace every legacy system,” he argued. “It's to know what you own, understand how inherited systems connect to the business, and continuously validate that the security controls protecting them work.”
WhiteArmor Ramps Up Attacks
A relatively new extortion group known as WhiteArmor claimed responsibility for the attack, according to screenshots of its leak site posted to X.
The group demanded $5m in Bitcoin, claiming it has 100GB of data linked to Maersk’s OCF/LF logistics platform, including driver records and plaintext passwords, staff accounts, delivery receipts, purchase orders, inventory rows, and mobile device logs containing phone numbers, email addresses and IMEIs.
WhiteArmor is behind a string of extortion demands ranging from $140,000 to $20m over the past month, according to Nick Harris, CISO at cyber-insurance specialist Assured.
Citing publicly available information on the attacks, he noted that several were aimed at the logistics sector, with victims including J.B. Hunt, Ryder, and Echo Global Logistics.
“The group describes itself as focused on data-theft extortion, intending to expand into ransomware, and says its encryptor is nearly complete,” Harris said.
“The protections include cycling credentials, strong access controls, data loss alerts and validating third parties. If they aim to recruit insiders, treat security as “assumed compromise” and set controls and alerts accordingly.
Maersk hasn’t experienced a serious cyber incident since the NotPetya campaign in 2017, which it claimed at the time may have cost the firm as much as $300m.
Image credit: Mariusz Bugno / Shutterstock.com