Skip to content
Ransomware News

maersk Data Breach: Whitearmor Ransomware Claim (Nov 2026)

Admin
HookPhish team

Summary

In the latest cybersecurity news, maersk — an organization based in DK — has fallen victim to a ransomware attack conducted by the group Whitearmor. This data breach, discovered on 2026-11-07T03:48:01.376268+00:00, underscores the increasing need for proactive cybersecurity defenses as we continue through 2026.

Incident Report

Attribute Information
Target Organization maersk
Threat Group Whitearmor
Summary Maersk is one of the world’s two largest container lines: founded in
1904, headquartered in Copenhagen, roughly 100,000 employees in about
130 countries, and USD 55.5 billion in revenue in 2024, with around
USD 12 billion of EBITDA. Your contract-logistics arm, the former LF
Logistics, runs fulfilment for many of the world’s largest consumer
brands. Five million dollars is roughly four hours of that EBITDA.

We hold approximately 100 GB of data from your OCF / LF Logistics
platform:

– 29,297 driver records, 16,093 of them with plaintext passwords
– 16,123 staff accounts, including 33 SUPER_ADMIN accounts
– 18,913 delivery recipients with names and street addresses
– 64,665 signed delivery receipts (214,107 documents in total)
– 14.44 million inventory rows, 189,248 purchase orders, 334,432 ASNs
– 27,842 mobile device logs containing phone numbers, emails and IMEIs

You have 30 days to contact us and pay USD 5,000,000 in bitcoin

Emails with instructions will be sent to you shortly, if you have failed to receive them,

Contact:
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Email: [email protected]

Date of Breach 2026-11-07T02:46:00+00:00
Discovery Date 2026-11-07T03:48:01.376268+00:00
Region DK
Business Sector Transportation

 

How to reduce your ransomware risk

Most ransomware intrusions start with a stolen password or a phishing email. A few proactive steps sharply cut your exposure:

Want to know if you’re already exposed? Run a free scan with the HookPhish data breach checker.

Disclaimer

HookPhish does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.

Related articles

Security training designed for people.

See how HookPhish turns phishing simulation, training and threat monitoring into measurable human-risk reduction.

Book a demo Explore solutions