Maersk reports new data breach after ransomware attack
The shipping company says attackers accessed an outdated IT system, but does not expect any disruption to services for now.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
.jpg){kind=link}
Maersk is investigating a cyber incident in which, according to the company, attackers extracted data from an outdated IT system. The Danish transport company says customers can continue booking and managing shipments as normal for now.
Maersk announced on 11 November that an attacker had gained access to a legacy system and stolen data from it. The company says the investigation is ongoing and that it has not yet been established exactly what information was viewed or copied.
According to Maersk, there are currently no indications that the attack has halted operational services. Customers can continue using the digital platforms for bookings and transport management. The company says it will inform affected parties if the investigation shows that additional notifications are required.
The attack recalls NotPetya, the devastating malware attack of 2017 that disrupted Maersk’s global network. According to a US government analysis, the company had to rebuild approximately 4,000 servers and 45,000 workstations at the time. The damage was estimated at hundreds of millions of dollars.
According to the available information, the current incident is not the same type of attack as NotPetya. A specialised cybersecurity publication reports that an extortion group named Maersk on a data-leak site and allegedly demanded five million dollars, but Maersk has not confirmed that claim.
For customers and logistics partners, the main concern is which data was stolen and whether attackers still have access. Maersk says cybersecurity is an ongoing priority and that it has measures in place to detect incidents and limit their consequences.
The case also underlines a familiar risk for large logistics companies: old systems can remain connected to modern business processes, even if they are no longer central to the infrastructure. As long as Maersk publishes no technical details or list of affected data, it remains unclear how great the risk is to customers and employees.
Also show where in Europe and in the world
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The article’s central point is based directly on Maersk’s statement. Claims about the ransom demand and the scale of the attack are clearly presented as unconfirmed.
- confirmed Maersk reported an incident involving an outdated IT system on 11 November. — Stated in Maersk’s statement. source
- confirmed Maersk does not expect any disruption for customers for the time being. — Maersk says customers can continue using the platforms. source
- confirmed NotPetya led to the rebuilding of approximately 4,000 servers and 45,000 workstations in 2017. — Described in the US CyOTE case study. source