Maersk said on 11 November that someone gained unauthorised access to one of its local legacy systems and pulled data out. The system came from an earlier acquisition. BleepingComputer reported that ransomware group WhiteArmor listed Maersk on its leak site over the weekend. The group demands $5 million in bitcoin within 30 days and says it holds about 100 GB.
Maersk says its findings so far strongly suggest no sensitive data was disclosed. It found no sign that other Maersk systems were affected. That includes customer and partner systems linked through APIs and EDI, the standard data links between companies. Maersk has not said which system, what data, or when the intrusion happened. WhiteArmor claims nearly 30,000 driver records, plaintext passwords and 33 SUPER_ADMIN accounts, the most privileged kind. Maersk's statement does not address these claims.
"Isolated" describes the system's links to other systems, not what the system itself held. A system bought in an acquisition can easily keep its own accounts and passwords, outside the parent's central controls. If WhiteArmor's claim is true, readable passwords and top-level accounts would let one foothold control that whole system. Buyers and operators can ask which acquired systems still run separately, who watches them, and how passwords are stored there.