By 
COPENHAGEN, Denmark, November 12, 2026 — Shipping and logistics group A.P. Moller–Maersk is investigating an information security incident involving unauthorised access to one of its local legacy IT systems inherited through a previous acquisition. The company confirmed on November 11 that data had been extracted from the system, while stating that its investigation had not identified evidence of an impact on its wider technology environment.
The incident highlights the security challenges faced by multinational companies that operate large technology networks built through years of acquisitions, integrations and infrastructure changes.
What Maersk Has Confirmed
According to the company, its cybersecurity team identified the issue and launched an investigation. Maersk said the affected system was local and belonged to a business acquired previously. The company has taken steps to secure the system, although it has not publicly disclosed when the unauthorised access began, how the attackers entered or precisely what information was extracted.
Maersk said its findings so far strongly suggested that sensitive data had not been disclosed. It also reported no indication that other Maersk systems or customer and partner systems connected through application programming interfaces and electronic data interchange had been affected.
Operational Impact Remains Limited So Far
The company said it did not anticipate disruption to customer operations and that clients could continue using its platforms to book and manage shipments. That distinction is important for a logistics group whose digital systems support cargo tracking, bookings, documentation and coordination across international supply chains.
However, the investigation remains ongoing. The company has not provided a final assessment of the extracted data or identified the party responsible. Any further conclusions will depend on forensic analysis and the review of the affected system.
Legacy Technology Creates Persistent Security Risks
Older systems can remain in use long after acquisitions are completed, particularly when they support local operations or specialised business processes. These environments may not always be integrated into the same security monitoring, identity management and patching frameworks as newer corporate infrastructure.
For large organisations, the incident underlines the need to maintain visibility over acquired technology, isolate systems that no longer require broad network access and apply consistent security controls across the entire corporate environment.
Maersk’s disclosure does not establish a wider compromise of its global operations. The key questions now are what data was accessed, whether the intrusion was contained completely and what additional safeguards will be introduced to prevent similar incidents.
Comments