Maersk breach: a system inherited from an acquisition, plaintext passwords and a $5M ransom
On November 11, 2026, shipping giant Maersk confirmed unauthorized access and data extraction in “a local legacy system from a previous acquisition”. The WhiteArmor ransomware group is demanding 5 million dollars in bitcoin, with a 30-day deadline, for about 100 GB of data.
This legacy system breach was nothing like a sophisticated attack, according to Danish outlet Ingeniøren. That’s exactly why it matters to small businesses: most of them also have an old system that nobody watches anymore.
What is confirmed, and what isn’t
✔️ Confirmed by Maersk
- Unauthorized access and data extraction took place
- The affected system is local and comes from a previous acquisition
- No impact found on other systems or on customer connections (APIs and EDI)
- Customer operations are not disrupted
- According to Maersk, findings "strongly suggest" no sensitive data was disclosed
❓ Claimed by the attackers, not verified
- The data reportedly comes from the OCF/LF Logistics platform (Maersk bought LF Logistics in 2022)
- About 29,000 driver records, 16,093 of them with plaintext passwords
- 16,123 user accounts, including 33 super-admins
- Signed delivery receipts, purchase orders and shipping notices
- The way in: admin credentials readable in plain text on a website
Maersk hasn’t named the acquired company and doesn’t confirm the attackers’ figures. Ingeniøren says, however, that it saw for itself, from material provided by WhiteArmor, that admin credentials were accessible in plain text on the web page involved.
What the attackers say they took
100 GB
of data claimed
16,093
driver passwords stored in plain text (according to the attackers)
33
super-admin accounts (according to the attackers)
30 days
to pay US$5M, per the ransom demand
How they reportedly got in: a door frame with no door
According to the attackers’ account reported by Ingeniøren, it took no unknown flaw, no phishing and no insider. The steps described:
A page of the legacy system exposed admin login information.
That information gave an admin token to the back-end systems.
The same password also opened super-user rights in the test and development environments.
The attackers say they then read the warehouse and transport systems and an archive of delivery documents.
A Danish ethical hacker quoted by Ingeniøren put it simply: it is barely a hack at all; it is basic IT that failed.
Legacy system breach: what your small business no longer sees
The legacy system inventory, in one hour
Take an hour this week with your IT lead and fill in this table. Every row without a clear answer is a priority.
| Question | Why | If the answer is "I don’t know" |
|---|---|---|
| Which sites, portals and software are still online, even if barely used? | You can’t protect what you don’t know about. | List your domain names and paid subscriptions. |
| Who is responsible for it today? | A system without an owner no longer gets updated. | Name a person or shut the system down. |
| Are passwords stored in plain text or in a page’s code? | That’s the way in described in the Maersk case. | Have the code and database checked. |
| Is the admin password the same in test and production? | A single password opened several environments. | Change them and turn on multi-factor authentication. |
| Does the system hold real customer or employee data? | Privacy law still applies to old systems. | Archive offline or anonymize, then delete. |
📋 Buying a company or taking on a major client?
Add an IT check to your list before signing: list of systems, admin accounts, data stored and date of the last update. Then, within 90 days, bring each system under your rules (passwords, multi-factor authentication, backups) or shut it down. Maersk’s legacy system dates from a 2022 acquisition.
We’ve seen this scenario before: real data in a test environment at the University of Copenhagen, and Staples’ “internal” tool reachable from the internet. To rate your own vendors, see also the lessons from the Crime Stoppers leak.
How NeoTech can help
For our managed IT services clients, we keep your systems inventory up to date, including old portals and test servers, with automated 24/7 monitoring with on-call technician intervention for unusual admin sign-ins. We also clean up generic accounts and access in Microsoft 365.
Book your free cyber check
In 30 minutes, we list with you your forgotten systems, the admin accounts to close and the data to remove from old servers.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- A.P. Moller – Maersk — IT security incident (Nov. 11, 2026)
- SecurityWeek — Maersk Confirms Data Theft Amid $5 Million Extortion Attempt
- BleepingComputer — Maersk confirms data breach as WhiteArmor ransomware demands $5 million
- Security Affairs — WhiteArmor Demands $5 Million from Maersk, Claims Theft of 100GB of Data
- Ingeniøren — Mærsk-hackere gik ind ad en åben dør (Nov. 12, 2026) (in Danish)
Photo: Jimmy Chan, Pexels (Pexels licence).