Maersk Plataforma OCF / LF Logistics da Maersk · Breach

WhiteArmor claims 100 GB theft from Maersk's LF Logistics

Nov 07, 2026 · 1 min read

Ransomware group WhiteArmor claims it stole about 100 GB from Maersk's OCF/LF Logistics platform and demands $5 million in Bitcoin, with a 30 day deadline before file release. The listing cites 29,297 driver records with 16,093 plaintext passwords and 16,123 staff accounts, including 33 super admin accounts. It is a group claim, unconfirmed by Maersk; cited drivers and staff should change reused passwords.

By HIFY Radar newsroom Updated 11/07/2026 03:56 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Ransomware group WhiteArmor claims it stole about 100 GB of data from Maersk's OCF/LF Logistics platform and demands $5 million in Bitcoin. The group gave the company 30 days before the files are scheduled for release. Maersk has not confirmed the claim.

Why it matters

If confirmed, the leak exposes plaintext driver and staff passwords, delivery recipient data, signed receipts, purchase orders, and mobile device logs with phone numbers, emails, and IMEIs. Customer and supply chain partner data would be at risk of fraud and account takeover.

What to do

Activate the incident response plan and investigate abnormal access on the OCF/LF Logistics platform. Tell affected drivers and staff to change reused passwords and enable multifactor authentication.

For the technical team

Affected: Maersk Plataforma OCF / LF Logistics da Maersk, transportadora e operadora logística dinamarquesa · Maersk OCF/LF Logistics platform (as claimed by the group).
Exploitation: Data theft claim by the WhiteArmor ransomware group, reported by Dark Web Informer; no technical exploitation described and no victim confirmation.
Fix: Not applicable; breach incident. No fix cited in the source.
Vector: Not described in the source. The claim concerns data theft tied to the OCF/LF Logistics platform; initial access method was not disclosed.
More details: The listing claims about 100 GB: 29,297 driver records with 16,093 plaintext passwords; 16,123 staff accounts including 33 SUPER_ADMIN; 18,913 delivery recipients; 64,665 signed delivery receipts covering 214,107 documents; 14.44 million inventory rows; 189,248 purchase orders; 334,432 ASNs; 27,842 mobile-device logs with phone numbers, emails, and IMEIs. Ransom demand: $5 million in Bitcoin. Deadline of 30 days before scheduled file release. Report source: Dark Web Informer.