What Happened
Maersk confirmed a threat actor breached a local legacy system inherited through an earlier acquisition, BleepingComputer reports. The WhiteArmor ransomware group claimed the attack and demands $5 million in bitcoin within 30 days. It says the data came from the OCF/LF Logistics platform. Maersk bought LF Logistics from Li & Fung in 2022.
WhiteArmor claims about 100GB of data. The list includes nearly 30,000 driver records, plaintext passwords, 33 SUPER_ADMIN accounts, signed delivery receipts, and 27,842 mobile device logs with phone numbers, emails, and IMEI numbers. These claims remain unverified. Maersk says current evidence shows no sensitive data disclosed. It reports no impact on other Maersk systems or on customer API and EDI links, and no expected disruption to bookings.
Why This Matters for Canadian Organizations
Maersk moves freight through Canadian ports and runs logistics for Canadian importers and retailers. Its customers here should expect phishing built on stolen delivery and driver data. Maersk itself warns customers to verify unexpected messages through their usual contact.
The bigger lesson concerns mergers. Acquired platforms often keep their own admin accounts, old password storage, and thin monitoring for years. Plaintext passwords and dozens of super admin accounts point to exactly this kind of neglected system. Canadian logistics, trucking, and warehousing firms have grown through acquisition too. Driver and device records count as personal information under PIPEDA, and a breach in an inherited system still belongs to the parent company.
What to Do
List every system you inherited through an acquisition and name an owner for each. Retire or isolate the ones you no longer need. Force password resets, enforce MFA, and audit admin accounts on the rest. Confirm logs from those systems reach your SOC. If you ship with Maersk, warn staff about invoice and delivery-change scams and verify payment changes by phone. Follow our Trends coverage and latest news for updates.
