A ransomware group calling itself Whitearmor has claimed to have stolen around 100GB of data from Maersk's OCF/LF Logistics platform and is demanding $5 million in Bitcoin. The claim was published on the group's leak site on 7 November 2026, according to threat intelligence reports tracking the listing. Maersk, one of the world's largest container shipping companies, has not publicly confirmed the claim, and no independent verification of the alleged theft has been published.

What the group claims to hold

According to the claim, the stolen data includes 29,297 driver records, of which 16,093 contain plaintext passwords. The group also claims to hold 16,123 staff accounts, including 33 with super-administrator privileges, and 18,913 delivery recipient records with names and street addresses. The listing further describes 64,665 signed delivery receipts totalling 214,107 documents, 14.44 million inventory rows, 189,248 purchase orders, 334,432 shipping notices and 27,842 mobile device logs containing phone numbers, email addresses and IMEI numbers. Whitearmor has given Maersk 30 days to make contact and pay.

Why the claim matters

If genuine, the exposure of plaintext passwords and super-administrator accounts would create a serious risk of further unauthorised access, especially if credentials are reused on other systems. Whitearmor is a newly emerged extortion group first tracked in October 2026, and it has previously named other logistics firms, including J.B. Hunt, Ryder and Echo Global Logistics. Security researchers note the group appears focused on data theft and extortion rather than file encryption. Drivers and staff linked to the platform should change their passwords and watch for phishing attempts using the exposed details.

[Source: QPulse / Quasar CyberTech](https://qpulse.quasarcybertech.com/news/7972/whitearmor-ransomware-group-claims-theft-of-100gb-of-data-from-maersk-ocf-lf-logistics-platform) | [Source: HookPhish](https://www.hookphish.com/blog/ransomware-group-whitearmor-hits-maersk/)