By 
COPENHAGEN, Denmark, November 13, 2026, Global shipping and logistics company A.P. Moller-Maersk has confirmed a cybersecurity incident involving unauthorised access to a legacy information technology system associated with a previously acquired business. The company said its investigation remains ongoing, while the affected system has been secured and no wider disruption to its operations has been identified.
In a notice published on November 11, Maersk said attackers had gained unauthorised access to a local legacy system and extracted data. The company stated that its initial findings indicated that no sensitive information had been disclosed and that there was no evidence of an impact on other Maersk systems or connected customer and partner environments.
Incident Linked to a Legacy Business System
The affected environment was described as a local system associated with a previous acquisition. This distinction is important because large companies often operate technology environments inherited through mergers and acquisitions, including older software, databases and infrastructure that may not be fully integrated into their central security systems.
Legacy systems can create additional security challenges when they remain operational after an acquisition. Differences in software versions, access controls, monitoring practices and maintenance schedules can make it difficult to apply uniform security standards across an organisation.
Maersk has not publicly disclosed all technical details of the incident, including the precise method used to gain access or the full extent of the extracted data. The company said its cybersecurity team launched an investigation after identifying the issue and took steps to secure the affected system.
Company Says Core Operations Remain Unaffected
Maersk stated that it had found no indication of an impact on its other systems or on customer and partner systems connected through application programming interfaces and electronic data interchange integrations.
The company also said it did not anticipate operational disruption and that customers could continue using its platforms to book and manage shipments. This is significant for a logistics operator whose digital services support booking, cargo tracking, documentation and communication across international supply chains.
However, the absence of immediate operational disruption does not automatically establish that an incident has no wider consequences. Investigations may identify additional affected information or systems as forensic analysis progresses.
Ransomware Claims Remain Separate From Confirmed Findings
A cybersecurity roundup published on November 13 reported that a ransomware group known as WhiteArmor had claimed responsibility and alleged that it had obtained approximately 100GB of data. The group reportedly demanded a ransom, but Maersk’s public notice did not confirm the alleged data volume, the ransom demand or the contents of the material.
Such claims should be treated cautiously until independently verified. Organisations facing extortion attempts may encounter exaggerated or misleading claims intended to increase pressure during negotiations.
Why Acquired Infrastructure Requires Attention
The incident highlights the importance of cybersecurity due diligence during acquisitions. Businesses that purchase other companies inherit not only customers and commercial operations but also technology environments that may contain unresolved vulnerabilities or outdated security controls.
Security teams need to identify legacy assets, review access permissions, remove unnecessary accounts and ensure that monitoring covers systems outside the primary corporate network. Regular testing and clear incident response procedures are also important.
For Maersk, the next stage will be to establish the full scope of the incident and determine whether any affected parties require further notification. The company has said it will provide updates if additional relevant findings emerge.
Comments