Maersk Faces Fresh Cyberattack on 11 Nov as Legacy System Breach Revives Memories of the $300 Million NotPetya Disaster

13 November 2026 | Logisticswall.com

A.P. Moller–Maersk is investigating another cybersecurity incident after unauthorised access and data extraction were detected in a local legacy IT system inherited through a previous acquisition. The company disclosed the incident on 11 November 2026, confirming that its investigation is ongoing and that the affected system has been secured.

Maersk said its findings so far strongly suggest that no sensitive data has been disclosed. It has found no indication of an impact on its wider IT infrastructure or customer and partner systems connected through API and EDI integrations. Booking and shipment-management platforms remain operational, with no disruption anticipated at present.

Maersk+1

Was a ransom demanded?

There is an important development beyond Maersk's official statement. Cybersecurity reports have linked the incident to the ransomware group WhiteArmor, which allegedly claimed responsibility and demanded US$5 million in Bitcoin.

The group reportedly claimed to have extracted around 100 GB of data. However, these figures and the ransom demand remain allegations by the attackers, not details independently confirmed by Maersk. The company has not publicly confirmed paying any ransom or accepted the group's account of the stolen information.

SecurityWeek+1

The shadow of the 2017 NotPetya attack

The latest incident inevitably recalls 27 June 2017, when Maersk was caught in the global NotPetya cyberattack. The malware spread across its global IT infrastructure, affecting Maersk Line, APM Terminals and Damco.

Employees in several locations found their computer screens displaying a ransom message demanding approximately US$300 in Bitcoin to restore access. However, NotPetya was not ordinary ransomware. It was a destructive malware attack, and paying the ransom would not have guaranteed recovery.

The consequences were enormous:

• Maersk estimated financial losses of US$250–300 million.

• Thousands of IT systems and business applications became unavailable.

• Port and terminal operations were disrupted, forcing employees to rely on manual processes.

• The recovery reportedly involved rebuilding approximately 4,000 servers, 45,000 PCs and 2,500 applications.

The bigger concern for global shipping

The November incident is different in scale from the 2017 disaster, but it highlights a vulnerability that deserves attention across the shipping industry: legacy IT infrastructure inherited through acquisitions.

Shipping companies increasingly operate through interconnected platforms covering bookings, documentation, customs, warehousing, terminals and cargo visibility. A weakness in an older system can become an entry point even when the company's primary operational network remains protected.

For Maersk, the immediate priority is to establish what information was extracted, whether the attackers retain access and whether any customers, employees or partners need to be notified.

The critical question is no longer simply whether a shipping company can protect its main network, but whether it can secure every system it has acquired along the way.

Editorial fact-check: The US$5 million ransom demand and 100 GB data-theft claim are attributed to the alleged attackers and remain unverified. Maersk has not confirmed them.