Maersk Cyber Incident Limited to Legacy System, Company Says

Maersk, the Danish shipping company, said in a statement reported by The Record that threat actors gained access to a “legacy system from a previous acquisition.” The company said the incident is isolated to a local system and does not affect other parts of the firm. Maersk did not disclose the cause or when the access began, and it said it does not expect disruptions for customers.

Maersk’s findings suggest no sensitive data has been disclosed, the company said. It gave few other details.

What Maersk says is and is not affected

The company stated it has found no sign of impact on other Maersk systems, or on customer and partner systems that connect to it through integrations such as APIs and EDI (electronic data interchange, the format used to exchange shipping documents between companies). Maersk reported 2025 revenue of $54 billion and is one of the largest shipping companies in the world, according to The Record.

The ransomware claim

The statement came three days after the WhiteArmor ransomware gang claimed an attack on LF Logistics, a Hong Kong-based transportation and logistics company that Maersk acquired in 2022. The gang said it stole 100GB of data and demanded $5 million within 30 days. The data allegedly includes information on drivers, warehouses and customers. These are the group’s claims. Maersk has not publicly tied its incident to them, and the cause of the incident has not been disclosed.

Brazil’s Santos port is still recovering

Separately, an attack on the Santos Port Authority, one of the largest in South America, began last Friday, The Record reported. It caused a power outage and later led to significant delays in loading and unloading cargo. Officials had to schedule routes and handle billing by hand. On Thursday the authority said it had recovered about 70% of its systems from backups. Brazil’s Federal Police are investigating.

The Record describes the Maersk incident as the latest in a string of attacks on ports and shipping organizations. Ports in the U.S., Europe and Asia have been repeatedly targeted by ransomware gangs over the last five years as more of them shift to digital operations. In 2024 the Port of Seattle refused to pay a ransom after an attack that caused problems at the city’s airport and seaport ahead of the Labor Day holiday. Maersk has itself dealt with ransomware that hit company systems and specific port operations before.

What this means for customers

Maersk says shipping customers should see no change, because the affected system is isolated and its connections to customer systems showed no impact. The company has not described any customer-facing outage. The situation at Santos is different: the port authority is still working to bring systems back, and cargo handling there was delayed.

Source: The Record