Maersk Investigates Breach of a Legacy System, Says No Sensitive Data Appears Exposed

A.P. Moller-Maersk, the world's second-largest container shipping company, says it is investigating an IT security incident after unauthorised access and data extraction from a local legacy system it inherited through an acquisition. The company says its findings so far strongly suggest no sensitive data was disclosed, the affected system has been isolated, and it does not expect any disruption to its operations.

The incident was disclosed on 11 November, and it is a reminder that even the most heavily defended companies can be exposed through older systems picked up in acquisitions.

What Maersk says happened

Maersk said it detected unauthorised access to a local legacy system — an older piece of IT infrastructure that came with a company it acquired — and that data was extracted from it. The system has been isolated, and the company says it is still investigating what was taken.

So far, Maersk says the findings "strongly suggest" that no sensitive data was disclosed. That wording is careful: the investigation is not finished, and the company is not yet in a position to say definitively what was and was not taken. It has not named the acquired company whose system was breached, or said when the intrusion happened.

The hacker group's claims

A hacker group calling itself WhiteArmor has claimed responsibility for the incident, saying it stole around 100GB of data, including 29,297 driver profiles, and demanding $5 million in bitcoin by 7 December. Maersk has not confirmed any of those claims, and they should be treated as unverified: groups claiming responsibility for breaches routinely inflate what they took, and their claims are sometimes false.

The Register, which first reported the group's claims, and Danish newspaper Ingeniøren both carried the WhiteArmor allegations. Maersk has not confirmed that the group was behind the intrusion.

Why a legacy system matters

Legacy systems are the weak point in many corporate networks. They are older, they may run software that no longer receives security updates, and they are often poorly documented because the people who built them have moved on. When a company acquires another business, it inherits those systems — and their vulnerabilities — along with the assets.

Maersk knows this better than most. In 2017, the NotPetya ransomware attack hit the company through a piece of compromised accounting software used by its Ukrainian operations, shutting down systems across the company and costing it hundreds of millions of dollars to recover. The company rebuilt its IT infrastructure after that attack, and the current incident appears to be far smaller in scale — but it shows that the problem of inherited systems has not gone away.

Why it matters

Maersk moves about a fifth of the world's container freight, so any disruption to its systems has the potential to ripple through global supply chains. The company says it does not expect disruption this time, and the scale of the breach — a single legacy system, with no sensitive data disclosed so far — suggests it has the situation under control. But the incident is a warning for any large company that has grown through acquisitions: the systems you inherit are only as secure as the weakest one, and the weakest one is usually the oldest. For Maersk, the test now is whether the investigation confirms that nothing sensitive was taken — and whether it finds the inherited system that let the attackers in before they find another one.

Sources

• Reuters — Shipping firm Maersk investigates IT security incident
• The Register — Maersk investigates IT security incident
• Ingeniøren — Maersk investigates IT security incident