{
  "id": "maersk-legacy-data",
  "url": "https://ohshit.app/incidents/maersk-legacy-data/",
  "title": "Maersk confirms data theft from one acquired legacy system",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-11-11",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Maersk",
    "logistics",
    "data breach"
  ],
  "ecosystems": [],
  "summary": "Maersk confirmed that data was exfiltrated from one legacy system inherited through an acquisition. Its preliminary findings indicate sensitive data was likely unaffected. The investigation is ongoing.",
  "splash": "One acquired legacy system. Maersk reports no indication of impact to customer or partner API and EDI integrations.",
  "wipe": "Continue using established shipping channels, verify unexpected communications and watch for Maersk’s investigation updates.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Continue normal shipping and booking",
      "hint": "Use your usual booking and shipping channels. Verify unexpected messages or requests about shipments through your established Maersk contact. Monitor the official notice for changes to integration status or customer instructions."
    },
    {
      "title": "Check evidence if notified of exposure",
      "hint": "Use the notice to identify the affected records and dates. Preserve related messages and integration audit logs. If the notice or your own investigation identifies exposed credentials, revoke them, replace them in dependent systems and verify the connections."
    }
  ],
  "sources": [
    {
      "name": "Maersk incident notice",
      "url": "https://www.maersk.com/news/articles/2026/11/11/it-security-incident",
      "says": "Confirms exfiltration, gives the preliminary assessment of sensitive data and describes service and integration status.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Maersk confirmed exfiltration from the affected system.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 11, 2026",
      "title": "Maersk discloses the incident",
      "body": "The company confirms data was exfiltrated from one legacy system and says the investigation is ongoing."
    }
  ],
  "body_markdown": "Maersk says it took steps to secure the local system and began an investigation. It expects no disruption to its operations and advised customers to continue booking and shipping. It reported no indication of impact to its other systems or to customer and partner integrations. Its initial assessment of sensitive data may change as the investigation proceeds. The notice gives no affected-record count or intrusion method."
}