Abstract:
Maersk, the global shipping and logistics giant, recently disclosed a cyber security incident. The company said a threat actor broke into the systems of a previously acquired subsidiary and stole some data. Currently, the relevant investigation is still ongoing, and a ransomware group called WhiteArmor has publicly claimed responsibility for the attack and demanded a $5 million Bitcoin ransom from Maersk.
Maersk said that after the company's network security team discovered the anomaly, it launched an investigation as soon as possible. According to current information, the incident involved an independent local system, and the company has not found evidence that sensitive data was leaked. Maersk emphasized that the incident did not affect its core business systems, and no systems accessed by customers and partners through API, EDI and other interfaces were found to be affected.
The company further stated that the incident is not expected to have an impact on the customer's business, and customers can still use the Maersk platform for freight booking, transportation management and other operations as usual. Currently, various logistics and shipping services maintain normal operations.
However, Maersk did not disclose more technical details, including the specific situation of the affected system, the time when the attack occurred, the intrusion method and the types of data that may be involved.
Although Maersk remains cautious about the details of the incident, cybersecurity media quoted relevant intelligence as saying that the ransomware organization WhiteArmor has published a statement about the attack on its data leak website and publicly demanded that Maersk pay a ransom of US$5 million.
The organization directly mentioned Maersk's LF Logistics business in the message, saying that this original contract logistics company provides fulfillment and supply chain services for many large consumer brands around the world. The attacker stated that $5 million is only equivalent to a few hours of profit for Maersk, and asked the company to contact it within 30 days and pay the ransom, otherwise it will face the risk of data disclosure.
Public information shows that LF Logistics is headquartered in Hong Kong, China and is a contract logistics and supply chain management company. In 2022, Maersk will complete the acquisition of the company for US$3.6 billion and integrate it into its own logistics territory.
WhiteArmor claims that it has stolen approximately 100GB of data from the OCF platform related to LF Logistics and has a large amount of sensitive information. According to the content released by the organization, the leaked data is said to include approximately 30,000 driver records, password information stored in clear text, 33 SUPER_ADMIN administrator accounts with the highest privileges, signed delivery receipts, and a large number of data records involving inventory, purchase orders, and advance shipping notices.
In addition, the attacker also claimed to have obtained more than 27,000 mobile device logs, which contained information such as phone numbers, email addresses, and device IMEI identification codes. Some third-party security agencies cited relevant data and pointed out that it may also involve warehousing records, employee accounts, logistics documents, etc., but these claims have not been independently verified.
Maersk has not yet confirmed the above accusations. The company said that the investigation is still ongoing and further updates will be provided to customers and partners in the future based on the situation.
Maersk also emphasized that the company has strict network security management and incident response mechanisms, aiming to detect and prevent security incidents as much as possible and minimize the impact on customer business. Whether this incident will be further expanded and the authenticity of the data claimed by the attackers remain to be revealed in subsequent investigations.
Comments