[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fe_fHtl_uZs1BWFu9Kp5bGOmfNeEOQjs1gO56QQUt6eE":3},{"article":4,"iocs":49,"watch_terms":53,"solutions":54,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"dfdc601e-b6e4-4ae4-8dd9-9e510c93d129","Maersk confirms data breach as WhiteArmor ransomware demands $5 million","maersk-confirms-data-breach-as-whitearmor-ransomware-demands-5-million-9d0e65","Maersk announced that a threat actor gained unauthorized access to a local legacy system inherited through an earlier acquisition and extracted data from it. [...]","Maersk confirmed a data breach originating from a legacy system acquired through a previous acquisition. The WhiteArmor ransomware group claimed responsibility, stating they exfiltrated approximately 100GB of data and are demanding a $5 million ransom. Maersk stated the incident is isolated and does not expect operational disruptions or impact on customer systems.","WhiteArmor ransomware group claims data breach at Maersk, demands $5 million.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmaersk-confirms-data-breach-as-whitearmor-ransomware-demands-5-million\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F11\u002Fmaersk.jpg","2026-11-11T16:24:18+00:00","2026-11-11T17:00:23.88921+00:00",7,[17,20,23],{"name":18,"type":19},"Maersk","vendor",{"name":21,"type":22},"WhiteArmor","threat_actor",{"name":24,"type":25},"OCF\u002FLF Logistics platform","product","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":26,"icon":28,"name":29,"slug":30},null,"Ransomware","ransomware",[32,37,42,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":43},{"id":26,"icon":28,"name":29,"slug":30},{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":21,"context":52},"malware","Ransomware group claiming responsibility for the breach.",[18,24],{"controls":55,"vendors":142},[56,84,113],{"slug":57,"name":58,"problem":59,"products":60},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":79,"url":82,"description":83},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":85,"name":86,"problem":87,"products":88},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"slug":114,"name":115,"problem":116,"products":117},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":153},"legacy-systems-from-acquisitions-become-ransomware-entry-points","Legacy Systems from Acquisitions Become Ransomware Entry Points","Maersk suffered a data breach and $5 million ransomware demand after attackers exploited a legacy system inherited through a corporate acquisition — a system that likely received less security scrutiny than core infrastructure. This highlights a persistent blind spot in M&A security: acquired assets often carry unknown vulnerabilities, outdated configurations, and insufficient monitoring that persist long after the deal closes. The exfiltration of 100GB of data before detection suggests the legacy system lacked adequate logging, network segmentation, or data loss prevention controls. Organizations that fail to integrate acquired systems into their security programs effectively expand their attack surface without expanding their defenses.",[148,149,150,151,152],"CIS Control 1: Inventory and Control of Enterprise Assets (v8)","NIS2 Article 21(2)(d)","NIS2 Article 21(2)(e)","NIST SP 800-53 SA-9: External System Services","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships",{"NIS2 Article 21(2)(d)":154,"NIS2 Article 21(2)(e)":155,"NIST SP 800-53 SA-9: External System Services":156,"CIS Control 1: Inventory and Control of Enterprise Assets (v8)":157,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":158},"This point requires security measures addressing supply chain risks, including risks from acquired entities; the legacy system from a prior acquisition was the direct entry point for this attack.","This point covers security in acquisition and maintenance including vulnerability handling; the inherited legacy system's unresolved vulnerabilities were the root cause of the breach.","This control requires organizations to assess and monitor the security posture of externally acquired systems and services, which would have surfaced the risk posed by the legacy acquired system before it was exploited.","This control requires maintaining an accurate inventory of all assets; the breach originated from a legacy acquired system that was evidently not fully tracked or secured within Maersk's asset management program.","This control requires managing information security risks associated with acquired or third-party systems, directly applicable to the failure to adequately secure the system ingested through the prior acquisition."]