Ransomware group Whitearmor hits maersk
maersk — a transportation target operating in DK has been listed by the Whitearmor ransomware group on 2026-11-07. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | maersk |
|---|---|
| Threat Group | Whitearmor |
| Summary | maersk, a transportation organization in Denmark, was listed by the Whitearmor ransomware group on its leak site on 2026-11-07. |
| Date of Breach | 2026-11-07 |
| Discovery Date | 2026-11-07 |
| Region | DK |
| Target Domain | — |
| Business Sector | Transportation |
| Severity | MEDIUM |
Claim by Whitearmor
Maersk is one of the world's two largest container lines: founded in 1904, headquartered in Copenhagen, roughly 100,000 employees in about 130 countries, and USD 55.5 billion in revenue in 2024, with around USD 12 billion of EBITDA. Your contract-logistics arm, the former LF Logistics, runs fulfilment for many of the world's largest consumer brands. Five million dollars is roughly four hours of that EBITDA. We hold approximately 100 GB of data from your OCF / LF Logistics platform: - 29,297 driver records, 16,093 of them with plaintext passwords - 16,123 staff accounts, including 33 SUPER_ADMIN accounts - 18,913 delivery recipients with names and street addresses - 64,665 signed delivery receipts (214,107 documents in total) - 14.44 million inventory rows, 189,248 purchase orders, 334,432 ASNs - 27,842 mobile device logs containing phone numbers, emails and IMEIs You have 30 days to contact us and pay USD 5,000,000 in bitcoin Emails with instructions will be sent to you shortly, if you have failed to receive them, Contact: Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 Email: whitearmorrxd@proton.me
Posted by the Whitearmor threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Leak post (onion / Tor)
http://whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion
Open this URL in Tor Browser. Browsing leak sites carries real risk — view passively, never click further.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.