Maersk probes IT security incident at legacy system, data theft suspected

Shipping giant Maersk said on Wednesday that it is investigating an IT security incident involving potential data theft from a legacy local system. The company said the affected system was secured immediately and that its findings so far strongly suggest no sensitive data has been disclosed, with no indication of impact on other Maersk systems or customer and partner systems connected through APIs and EDI.

Incident scope and operations

Maersk described the affected system as a legacy local system from a previous acquisition. It said the incident is isolated to that system and that it does not expect the attack to affect operations. Customers can continue to use Maersk platforms to manage shipments as usual, and the company said it will provide updates as they become available.

Company response

Maersk said cybersecurity remains a constant, ongoing priority and that it has rigorous processes to identify and prevent incidents and minimize customer impact. It also advised customers to treat unexpected communications claiming to relate to the matter with caution and verify them through their usual Maersk contact.

NotPetya comparison

The disclosure may bring to mind Maersk's 2017 NotPetya experience, when destructive wiper malware spread across the global economy and was attributed by Western intelligence agencies to Russia's Sandworm group, believed to be part of the GRU. Maersk said at the time that it expected a bill of about $300 million, and later described a rebuild involving 4,000 new servers, 45,000 new PCs, and 2,500 applications completed over ten days. In 2020, Maersk laid off around 150 staff from its command and control center in Maidenhead, England, including staff who had played key roles in the recovery.

Sources: The Register