On this page
Danish shipping group A.P. Moller-Maersk said on Wednesday 11 November 2026 that it is investigating an IT security incident in which someone gained unauthorised access to one of its older systems and extracted data. In a customer advisory published on its website, the company said the affected system has been secured, that its findings so far "strongly suggest no sensitive data has been disclosed", and that it does not expect disruption to customers.
The company has not said what data was taken, how much, or who was responsible. A criminal group has publicly claimed the intrusion, but Maersk has not confirmed that claim. This article sets out what is confirmed, what is only claimed and what remains unknown.
What has Maersk confirmed?
Maersk's statement is short, and every confirmed fact about the incident comes from it. The company says it "identified an IT security incident involving unauthorised access and data extraction from one of our local legacy systems from a previous acquisition".
According to the advisory, the sequence was as follows:
- Maersk's own cyber security team discovered the issue.
- A full investigation was launched immediately and is still under way.
- Action was taken to secure the affected system.
Maersk describes the incident as "isolated to a local system". It says it has found no indication of any impact on other Maersk systems, or on customer and partner systems that connect to Maersk through integrations such as APIs and EDI (electronic data interchange, the standard way shipping documents are passed between companies).
On data, the wording is careful. Maersk does not say that nothing sensitive was taken. It says its findings so far "strongly suggest" that no sensitive data has been disclosed, and adds that if it identifies any need to inform affected parties of further findings, it will do so.
Are Maersk bookings and shipments affected?
Not according to the company. Maersk says it does "not anticipate disruption to operations for customers at this time" and that customers can continue to use its platforms to book and manage shipments as usual.
That is the main difference from the event most people associate with Maersk and cyber security, which is covered further down. The Register, which reported the statement on 11 November 2026, drew a similar contrast, saying the intrusion will not be as calamitous as the 2017 attack. On Maersk's account this is data extracted from one legacy system, not an event that stopped the business from operating.
Maersk also gave customers one piece of practical guidance. It asked them to treat any unexpected communications claiming to relate to the incident with caution, and to verify them through their usual Maersk contact.
Who is behind it?
Maersk has not named anyone, and its statement does not mention a ransom demand or extortion.
Separately, trade publications report that a criminal group has claimed responsibility. Smart Maritime Network reported on 12 November 2026 that a group calling itself WhiteArmor made the claim over the weekend before Maersk's statement, saying it had obtained about 100GB of data from a platform it described as OCF / LF Logistics, and demanding US$5 million in Bitcoin.
Marine Insight reported the same claim and noted that Maersk has not confirmed the group's account, has not linked the incident to WhiteArmor, and has not named LF Logistics.
These are claims made by a criminal group and have not been independently verified. Groups of this kind have an obvious interest in overstating what they hold. We are not repeating the group's more detailed description of the data for that reason.
One piece of background is on the record. Maersk acquired LF Logistics from the Li & Fung Group in 2022, according to Smart Maritime Network. Maersk's statement refers only to "a previous acquisition" and does not say which one.
Confirmed, claimed and unknown
| Point | Status | Source |
|---|---|---|
| Unauthorised access to a local legacy system, with data extracted | Confirmed | Maersk statement, 11 November 2026 |
| System came from a previous acquisition | Confirmed, acquisition not named | Maersk statement |
| Affected system secured, investigation ongoing | Confirmed | Maersk statement |
| No sensitive data disclosed | Maersk's preliminary finding, not a final conclusion | Maersk statement |
| No disruption to customer operations expected | Maersk's assessment "at this time" | Maersk statement |
| WhiteArmor responsible, about 100GB taken, US$5 million demanded | Claimed by the group, not confirmed by Maersk | Trade press reports |
| What data was taken and whose it is | Unknown | Not disclosed |
| How and when the intruder got in | Unknown | Not disclosed |
Why does Maersk's history matter here?
Maersk is one of the world's largest container carriers. Marine Insight notes that the company was founded in 1904, is headquartered in Denmark and serves 130 countries. A security statement from a company of that size gets attention in any case, but Maersk also has a particular history.
In 2017 the company was one of the highest-profile victims of NotPetya, destructive malware disguised as ransomware. As The Register recounts, Maersk said at the time that it expected the attack to cost about $300 million. In 2018 its then chair, Jim Hagemann Snabe, told the World Economic Forum that the rebuild involved 4,000 new servers, 45,000 new PCs and 2,500 applications, completed over ten days.
There is a UK link to that story. The Register reported in 2020 that Maersk laid off around 150 staff from its command and control centre in Maidenhead, a team that had played a key role in the NotPetya recovery.
Nothing in Maersk's statement suggests the current incident is comparable in scale. NotPetya took the company's systems down. This incident, on Maersk's account, involves data copied from a single older system while everything else keeps running.
Analysis: what the wording tells us
This section is our own analysis, not reporting of new facts.
The statement is hedged, and that is appropriate. Phrases such as "findings so far", "strongly suggest" and "at this time" signal that the investigation is at an early stage. Readers should treat the reassurance about sensitive data as a provisional position that could be revised in either direction.
Inherited systems are a recurring weak point. Maersk's own description puts the problem in a legacy system from an acquisition. When a company buys another business it also takes on that business's software, accounts and data. Older platforms that sit outside the main estate can be harder to monitor and slower to retire. That is a general observation about acquisitions, not a finding about how this intrusion happened, which Maersk has not disclosed.
The follow-on risk is impersonation. Maersk's warning about unexpected communications is the most useful line in the advisory for customers. After any publicised incident, fraudsters can send messages that use the news as a pretext. Checking with a known contact, as Maersk asks, is a simple defence. It is the kind of supply chain and social engineering risk we covered in our overview of cybersecurity challenges for businesses.
What happens next?
Maersk says it will keep customers updated "as more relevant information becomes available". The open questions are the ones the statement leaves unanswered: what the extracted data contains, whose information it is, how the access happened, and whether the public claim of responsibility relates to the same system. We will update this story if Maersk publishes further findings.
Sources
FAQ
Frequently asked questions
On 11 November 2026 Maersk said it had identified an IT security incident involving unauthorised access to, and data extraction from, a local legacy system that came from a previous acquisition. It has secured the system and is still investigating.
Maersk has not said what data was taken. It says its findings so far strongly suggest no sensitive data has been disclosed, and that it will inform affected parties if further findings make that necessary. That is a preliminary position, not a final conclusion.
Yes, according to the company. Maersk says it does not anticipate disruption to customer operations at this time and that its platforms can be used to book and manage shipments as usual.
Maersk has not named anyone. Trade publications report that a group calling itself WhiteArmor has claimed responsibility and demanded US$5 million, but Maersk has not confirmed that claim and it has not been independently verified.
Not on the information available. NotPetya disabled Maersk's systems and forced a rebuild of thousands of servers and PCs. Maersk describes the current incident as isolated to one local legacy system, with no impact found on its other systems.
Spotted an error? Tell us. Read how we report and correct stories in our editorial policy.
Written by
Mainstream Tech
Newsroom
News and analysis on technology, AI, business, politics and international affairs, from our newsroom in London.
More from Mainstream
