- Maersk says attackers accessed a legacy system from a previous acquisition, and that the incident is isolated and does not affect customers.
- A ransomware gang separately claims it stole 100GB from LF Logistics, which Maersk acquired in 2022. Maersk has not confirmed a link in the statement The Record quotes.
- Leaders should list the systems they inherited in deals and test whether those systems are truly separate from core operations.
A company also buys the computers it acquires
When a company buys another, it gets the customers, the staff and the contracts. It also gets the computers. Those computers may be older than the parent's own, and may follow different rules. Maersk's statement this week shows why that matters to a board.
What Maersk has said
Maersk, the Danish shipping company, said threat actors gained access to a "legacy system from a previous acquisition." It said the incident does not affect other parts of the firm. The Record reported that Maersk had 2025 revenue of $54 billion and gave few details of the attack.
The company says its own review points to no exposure of sensitive data, and it does not expect customers to see disruption. In its words, the incident is "isolated to a local system." Maersk said it found no sign of impact on other Maersk systems, or on customer and partner systems that connect through integrations such as APIs and EDI.
What a ransomware gang claims
A ransomware group called WhiteArmor had said, three days before Maersk's statement, that it attacked LF Logistics. The Record describes LF Logistics as a Hong Kong-based logistics company that Maersk acquired in 2022. The gang claims it stole 100GB of data and demanded $5 million in 30 days. It says the data includes information on drivers, warehouses and customers.
These are the gang's claims. The Record does not say Maersk has confirmed them. Maersk's statement, as quoted, does not name LF Logistics or say which system was affected. Readers should treat the two events as possibly related, not as proven to be the same incident.
What "isolated" has to mean
APIs are the connections that let one company's software talk to another's. EDI, short for electronic data interchange, is a standard way for businesses to exchange orders and shipping documents by machine. Maersk named both as examples of the integrations customers and partners use.
Isolation is a design fact, not a statement of comfort. It means the inherited system's logins, network paths and integrations were kept apart from the parent's core. Maersk says that held. Customers cannot check it themselves, so they rely on the company's findings.
The lesson here is that a company's security boundary follows its deal history, not its org chart. Each acquisition adds a system that someone must own, update and, one day, retire. Systems like this often stay running because they still work.
The wider shipping picture
The Record places the Maersk incident among other attacks on ports and shipping firms. Its reporter writes that over the past five years, ransomware crews have repeatedly hit ports in the U.S., Europe and Asia, a period in which many ports moved more of their work onto digital systems. One example it gives: Seattle's port declined to pay a ransom in 2024 after an attack disrupted its airport and seaport.
The same report describes a separate attack on Brazil's Santos Port Authority, one of the largest ports in South America. The attack started the previous Friday and brought a power outage. Cargo loading and unloading slowed significantly, and officials had to schedule routes and handle billing by hand. By Thursday the authority said it had recovered about 70% of its systems from backups. Brazil's Federal Police are investigating. The report does not link this attack to Maersk.
The two cases stand at different points. Santos's operations were disrupted, while Maersk says its incident stayed in one system. The sources do not explain why. Maersk's account is its own, and the incidents differ in kind: one is an attack on a legacy system, the other a ransomware attack on a port authority.
Questions to put to your team
Which systems did we inherit through acquisitions, and who owns each one today? Do any share logins, network paths or API connections with our core systems? Could we prove that separation to a customer who asks, with a test and not a diagram?
Finally, whatever the facts of this case, what personal data do those older systems hold about drivers, customers or partners? Santos recovered about 70% of its systems from backups, so ask when your own restores were last tried. Would our isolation and our restores hold up if tested? A deal is not finished when the contract is signed. It is finished when the inherited system is either retired or held to the same standard as the rest.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Record.
