Shipping giant Maersk says recent cyber incident affected legacy system
Maersk confirms cyber incident impacting a legacy system from a previous acquisition.
Shipping giant Maersk has reported a cyber incident affecting a legacy system acquired from LF Logistics, a company it purchased in 2022. While Maersk states the incident is isolated and does not impact other systems or customer data, the WhiteArmor ransomware gang has claimed responsibility for attacking LF Logistics, alleging the theft of 100GB of data. This incident follows a pattern of attacks on the shipping and logistics sector, including a recent ransomware attack on Brazil's Santos Port Authority.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Maersk?
Get an email when a new story names Maersk, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonWhen Maersk acquired LF Logistics in 2022, it also inherited its legacy IT infrastructure — and the security debt that came with it. The WhiteArmor ransomware gang exploited this legacy system, allegedly exfiltrating 100GB of data, illustrating how M&A activity can silently expand an organization's attack surface. Legacy systems acquired through mergers are frequently under-patched, poorly documented, and inadequately integrated into the acquiring company's security controls. This incident underscores that security due diligence cannot end at the deal closing — inherited systems must be rapidly assessed, hardened, or decommissioned to prevent them from becoming a weak link in an otherwise mature security posture.
What helps against this
How we list vendors- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — WhiteArmor