A.P. Moller-Maersk says it is investigating “an IT security incident” involving possible theft of data from a legacy system, according to a statement issued on Wednesday.
What Maersk has confirmed
The Denmark-based shipping, cargo and logistics group said the affected system was secured and that findings so far “strongly suggest no sensitive data has been disclosed”. It described the machine as a local system inherited from a previous acquisition.
Maersk said it found no indication of impact on other Maersk systems, or on customer and partner systems that connect through integrations such as APIs and EDI, and that it does not expect operational disruption. Customers were told to keep using its platforms as normal.
The company also warned them to treat unexpected communications about the matter with caution and verify through their usual Maersk contact, the standard warning when a breach notice creates cover for follow-on phishing.
Why the name triggers alarm
Any mention of Maersk and IT security in the same sentence recalls NotPetya in June 2017, when a wiper attributed to Russia’s Sandworm group spread through the company’s estate and forced a rebuild of 4,000 servers, 45,000 PCs and 2,500 applications in about ten days. Maersk put the bill at roughly $300M.
The wording this time points somewhere much smaller. Maersk called the incident isolated to a local system rather than describing lateral movement, and the absence of any reference to lost availability suggests a contained intrusion rather than a destructive event.
The operational takeaway is about acquisition debt. A machine inherited from a takeover, still holding data and still reachable, is exactly the kind of asset that falls outside the current owner’s patching and monitoring patterns, and it is worth inventorying before someone finds it for you.
