1. Executive summary
On 2026-11-07 the extortion group Whitearmor posted a claim on ransomware.live that it holds approximately 100 GB of data taken from Maersk's OCF / LF Logistics platform, and demanded USD 5,000,000 in bitcoin within 30 days. The post lists specific record counts, including 16,093 driver records with plaintext passwords, 16,123 staff accounts of which 33 are SUPER_ADMIN, and 27,842 mobile device logs carrying phone numbers, emails and IMEIs. Maersk has not confirmed the claim in public reporting and no access vector, exfiltration date or affected version is stated. The direct risk to EMEA financial services is indirect: Maersk and its contract-logistics arm sit in the supply chains of consumer brands that banks finance, insure and clear trade for, and the leaked credential and identity data could be reused against counterparties. Whitearmor has no MITRE ATT&CK profile, so the attribution is unconfirmed and the listing is an operator claim only.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
The only public artefact is the Whitearmor leak-site post. It establishes an operator claim: that the group holds roughly 100 GB of data from the OCF / LF Logistics platform and will release it unless USD 5,000,000 in bitcoin is paid within 30 days. It does not establish how the data was obtained, when, whether Maersk has verified the exfiltration, or whether any of the record counts are accurate. No initial-access vector, exploited CVE, malware family, persistence mechanism or command-and-control detail appears in the post.
The claimed data set, as the operator describes it:
- 29,297 driver records, 16,093 of them with plaintext passwords
- 16,123 staff accounts, including 33 SUPER_ADMIN accounts
- 18,913 delivery recipients with names and street addresses
- 64,665 signed delivery receipts, 214,107 documents in total
- 14.44 million inventory rows, 189,248 purchase orders, 334,432 ASNs (advance ship notices)
- 27,842 mobile device logs containing phone numbers, emails and IMEIs
The composition points to a logistics-operations platform rather than corporate IT: driver credentials, staff accounts with administrative roles, delivery receipts and advance ship notices are the working data of a fulfilment business. If the counts are accurate, the plaintext driver passwords and the SUPER_ADMIN accounts are the highest-value items, because they would allow an attacker to authenticate to the platform rather than merely read exported records. Adverse Trace assesses that this is likely, but it rests only on the operator's own description and has not been corroborated by Maersk or any third party.
The post gives a contact email at proton.me and a 64-character session string. Neither is a network indicator that can be blocked at the perimeter; they are extortion-channel identifiers. No malware hash, domain, IP address or file path is published.
Attribution is unconfirmed. Whitearmor has no MITRE ATT&CK profile, and the only source for the group's identity, capability and intent is its own leak-site post. The claim that Maersk is a victim is single-sourced to ransomware.live, which indexes operator posts without verifying them.
4. Mitigation & containment
The item names no vulnerability, no affected product version and no vendor fix, so there is nothing to patch on the basis of this advisory. The actions below address the exposure a client faces as a counterparty or downstream consumer of the claimed data.
P1 within 24h
- Identify any third-party, logistics or fulfilment relationship with Maersk or its contract-logistics arm and confirm with the relationship owner whether any client credentials, API keys or shared accounts are held on the OCF / LF Logistics platform. Rotate any that are.
- Search authentication logs for use of client-side accounts against Maersk or LF Logistics portals from unexpected geographies or at unusual hours, and alert on any SUPER_ADMIN-equivalent activity on shared platforms.
- Brief trade-finance and supply-chain finance teams that counterparty identity data (names, addresses, staff emails, phone numbers) attributed to Maersk may appear in phishing or business-email-compromise attempts in the coming weeks.
P2 within 72h
- Where clients receive driver or delivery data from Maersk or LF Logistics, check whether any of that data includes plaintext passwords or reusable credentials and force a reset on any matching account in the client's own estate.
- Add the extortion contact domain (proton.me) to mail-flow rules that quarantine inbound messages from free-mail providers claiming to be a logistics counterparty, and brief the service desk on the pattern.
P3 within 7 days
- Review supplier contracts for notification obligations that would require Maersk or LF Logistics to tell the client about a data breach affecting shared data, and confirm the contact path.
- Re-run a review of which client systems trust identity assertions or data feeds from logistics providers, and reduce standing trust where it is not needed.
No fixed release or vendor patch is named in public reporting because the item describes a data-theft claim, not a software vulnerability.
5. Indicators of compromise
No atomic indicators of compromise are available in the source material. The only contact values in the post are an extortion email address and a session string, neither of which is a pivotable network indicator.
| type | value | confidence | source |
|---|---|---|---|
| n/a | n/a | n/a | n/a |
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Authentication to Maersk or LF Logistics portals using client-held or shared credentials from unexpected locations | Portal and SSO authentication logs | Low (operator claim only) |
| Inbound email from a free-mail provider impersonating a logistics counterparty and referencing a data claim or payment | Mail gateway and service-desk tickets | Low (operator claim only) |
| Use of leaked staff names, emails or phone numbers in phishing against client staff | Mail gateway, EDR on endpoints | Low (operator claim only) |
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- ransomware.live, "Victim: maersk – Whitearmor", https://www.ransomware.live/id/bWFlcnNrQFdoaXRlYXJtb3I=, 2026-11-07
8. Adverse Trace position
Adverse Trace assesses this as a low-severity item for EMEA financial services clients. It is a single leak-site listing by a group with no MITRE ATT&CK profile, the victim is a shipping and logistics company rather than a financial institution, and Maersk has not confirmed the claim in public reporting. The claimed data set is specific enough to be credible in outline, and the plaintext driver passwords and SUPER_ADMIN accounts would be the items to watch if the claim is confirmed. We will monitor for Maersk confirmation, for any appearance of the claimed data in criminal markets, and for follow-on phishing that uses the leaked identity data against counterparties, and we will reissue this advisory if any of those materialise. Clients with direct logistics or trade-finance exposure to Maersk should treat the P1 credential-rotation steps as precautionary and proportionate to that exposure.
Published via PulseTrace — Adverse Trace threat intelligence.