Maersk says cyber incident hit LF Logistics legacy system after WhiteArmor claims 100GB theft

Maersk said a cyber incident affected a legacy system tied to a previous acquisition, after the WhiteArmor ransomware group claimed it attacked LF Logistics, a Hong Kong-based transportation and logistics company Maersk bought in 2022. The group said it stole 100GB of data and demanded $5 million within 30 days. Maersk said the incident was isolated to a local system and found no indication of impact on other Maersk systems, customer systems or partner integrations using APIs and EDI.

The evidence trail is split. Maersk did not name the attacker, confirm ransomware or describe forensic indicators, but said its findings suggest no sensitive data was disclosed and no customer disruption is anticipated. WhiteArmor's claim alleges the stolen set included LF Logistics driver, warehouse and customer information. The disclosure lands amid another operational disruption: Brazil's Santos Port Authority said it recovered about 70% of systems from backups after a ransomware attack that caused a power outage and forced manual scheduling.

Shipping and port networks are a known ransomware target because digitized scheduling, billing and cargo handling create leverage. Maersk has previously dealt with ransomware affecting company systems and port operations, while the Port of Seattle in 2024 refused a ransom after criminals disrupted its airport and seaport ahead of Labor Day. The LF Logistics case fits that pattern but adds an acquisition angle: systems inherited through corporate deals can remain less hardened than a parent company's main network.

For shippers and consumers, the incident matters because global logistics depends on a chain of digital systems that move goods from warehouses to ports to delivery networks. Maersk said its customer and partner connections were not affected, limiting the immediate disruption. The Santos attack shows how quickly a cyber incident can force manual billing and scheduling, delay cargo and expose operational fragility. LF Logistics handles transportation and warehousing, so the claimed stolen data touches people and assets that support everyday trade.