Criminals have broken into the systems of a Maersk company. They stole data and are demanding a ransom. It is not the first time Maersk has fallen victim to ransomware.
Danish shipping company Maersk has fallen victim to a ransomware attack. Criminals who are part of the WhiteArmor group claim they have stolen 100 GB of data. They threaten to make it public unless Maersk coughs up five million dollars in bitcoin.
Subsidiary
The attack targeted a logistics subsidiary of Maersk: LF Logistics. LF Logistics has been part of the organisation since 2022. The thieves speak of a haul that includes unencrypted passwords, including those of privileged accounts, along with phone numbers and orders.
The shipping company itself states that the stolen data is not sensitive and that there is no impact on the company’s operations. Maersk has some 700 container ships sailing under its flag, accounting for more than 13 percent of the global fleet.
According to the shipping company, the attack is said to have been limited to what it calls a local system. Customers will be informed if necessary.
Not the first time
The impact therefore seems limited on balance. Maersk has been through this before. The multinational is one of the first companies to be visibly brought to its knees by ransomware. In 2027, NotPetya software penetrated its IT infrastructure and destroyed it almost completely. NotPetya had infected all of the company’s domain controllers.
The company was saved from an unlikely quarter. A Maersk office in Ghana had gone offline because of a blackout, and was still isolated when the malware tore through the systems. One intact domain controller was physically carried out of Ghana on a hard drive, and enabled the company to restore its systems after ten days. The attack cost Maersk around 300 million dollars.