Global shipping giant A.P. Moller–Maersk has confirmed an IT security incident involving unauthorized access and data extraction from a legacy system inherited through a previous acquisition.
The company disclosed the incident on November 11 and said its cybersecurity team immediately launched an investigation and secured the affected system.
Maersk has not identified what information was extracted or how much data was taken. However, preliminary findings suggest no sensitive information was disclosed. The company said the incident appears isolated to the affected system, with no indication that other Maersk infrastructure or customer and partner systems connected through APIs and electronic data interchange (EDI) were compromised.
The incident comes nearly a decade after the company’s devastating 2017 NotPetya attack, which reportedly cost approximately $300 million.
Seemant Sehgal, Founder & CEO, BreachLock
“Acquired systems arrive with their own credentials, their own patch schedule, and connections into the parent network that were set up during integration and rarely revisited. Ownership of these systems often gets blurred during acquisitions, so any company that grew through acquisitions should know how many of these systems it inherited and what each one can still reach. A penetration test during due diligence answers that before the deal closes, while there is still leverage to fix it.”
ㅤ
John Strand, Black Hills Information Security
“This breach and the way it’s being handled remind me of the Oracle Health breach involving an acquired company’s legacy systems. It’s weird to see companies talk about an acquired system as though that somehow absolves them of responsibility.
“You bought the company. As soon as the ink is dry, securing those systems is your responsibility. Calling them ‘legacy’ doesn’t change that.
“This is why security due diligence needs to be a serious part of mergers and acquisitions. You need to understand what you’re buying, what’s exposed, and what it will take to secure it. If something catastrophic happens, pointing to the previous owner isn’t much of a defense. You can still be left dealing with the legal exposure and the damage to your customers.”
ㅤ
Damon Small, Board Member, Xcape, Inc.
“Unchecked technical debt from corporate acquisitions remains an enterprise blind spot, yet rapid containment can mean the difference between an operational footnote and a multi-million-dollar catastrophe. Maersk’s November 11 disclosure of an isolated breach in an inherited legacy system appears relatively benign, especially with core logistics platforms and partner electronic data interchange (EDI) feeds uninterrupted. Still, against the backdrop of escalating critical infrastructure attacks globally, the incident underscores the vital role freight and supply chains play in modern society. A decade ago, the devastating 2017 NotPetya campaign cost Maersk an estimated $300 million dollars, but that institutional scar tissue clearly hardened their incident response posture, enabling defenders to isolate the compromised asset before data extortion could threaten vessel movements,cargo flow, or impact customer operations in any significant way. For executive leadership, the mandate is clear: cyber due diligence during mergers and acquisitions must match the rigorous scrutiny applied to financial audits. When organizations inherit digital infrastructure without auditing obsolete servers, unmonitored databases and applications inevitably turn into prime targets for threat actors seeking an easy corporate foothold.
“Critical Takeaways
- Audit acquisition tech debt with financial fervor: Security teams must evaluate inherited legacy environments with the same rigor applied to corporate balance sheets, ensuring unmonitored systems are identified, segregated, or decommissioned promptly.
- Network segmentation preserves operations: Restricting the affected legacy system from core logistics networks and partner EDI connections prevented lateral movement and kept physical cargo operations running without interruption.
- Prior crisis investments build real resilience: The severe operational fallout from the 2017 NotPetya attack forced Maersk to mature its recovery playbooks, turning what could have been a debilitating crisis into a contained, manageable event.
“The 300 million dollar lesson from 2017 paid off: this time, the legacy server took the hit while the ships kept moving.
ㅤ
Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security
“The most interesting part of this incident isn’t that Maersk was breached. It’s that the affected system was inherited through an acquisition. That’s a familiar enterprise security challenge. Companies acquire businesses, integrate operations, and sometimes inherit technology that doesn’t receive the same visibility, testing, or security attention as the rest of the enterprise. Maersk’s preliminary findings suggesting the incident was isolated and no sensitive information was disclosed are encouraging. But unauthorized access and data extraction still warrant investigation. The important questions are what the attackers accessed, how they gained entry, and whether the boundaries separating that legacy environment from other systems held. The lesson for organizations isn’t simply to replace every legacy system. It’s to know what you own, understand how inherited systems connect to the business, and continuously validate that the security controls protecting them work.
“An acquisition may close financially in a few months. The security obligations can last decades.”
Legacy systems can be a headache. You need to do your homework and make sure that this is one less headache for you.
Related
This entry was posted on November 11, 2026 at 4:45 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Maersk confirms cyberattack involving data theft from legacy system
Global shipping giant A.P. Moller–Maersk has confirmed an IT security incident involving unauthorized access and data extraction from a legacy system inherited through a previous acquisition.
The company disclosed the incident on November 11 and said its cybersecurity team immediately launched an investigation and secured the affected system.
Maersk has not identified what information was extracted or how much data was taken. However, preliminary findings suggest no sensitive information was disclosed. The company said the incident appears isolated to the affected system, with no indication that other Maersk infrastructure or customer and partner systems connected through APIs and electronic data interchange (EDI) were compromised.
The incident comes nearly a decade after the company’s devastating 2017 NotPetya attack, which reportedly cost approximately $300 million.
Seemant Sehgal, Founder & CEO, BreachLock
“Acquired systems arrive with their own credentials, their own patch schedule, and connections into the parent network that were set up during integration and rarely revisited. Ownership of these systems often gets blurred during acquisitions, so any company that grew through acquisitions should know how many of these systems it inherited and what each one can still reach. A penetration test during due diligence answers that before the deal closes, while there is still leverage to fix it.”
ㅤ
John Strand, Black Hills Information Security
“This breach and the way it’s being handled remind me of the Oracle Health breach involving an acquired company’s legacy systems. It’s weird to see companies talk about an acquired system as though that somehow absolves them of responsibility.
“You bought the company. As soon as the ink is dry, securing those systems is your responsibility. Calling them ‘legacy’ doesn’t change that.
“This is why security due diligence needs to be a serious part of mergers and acquisitions. You need to understand what you’re buying, what’s exposed, and what it will take to secure it. If something catastrophic happens, pointing to the previous owner isn’t much of a defense. You can still be left dealing with the legal exposure and the damage to your customers.”
ㅤ
Damon Small, Board Member, Xcape, Inc.
“Unchecked technical debt from corporate acquisitions remains an enterprise blind spot, yet rapid containment can mean the difference between an operational footnote and a multi-million-dollar catastrophe. Maersk’s November 11 disclosure of an isolated breach in an inherited legacy system appears relatively benign, especially with core logistics platforms and partner electronic data interchange (EDI) feeds uninterrupted. Still, against the backdrop of escalating critical infrastructure attacks globally, the incident underscores the vital role freight and supply chains play in modern society. A decade ago, the devastating 2017 NotPetya campaign cost Maersk an estimated $300 million dollars, but that institutional scar tissue clearly hardened their incident response posture, enabling defenders to isolate the compromised asset before data extortion could threaten vessel movements,cargo flow, or impact customer operations in any significant way. For executive leadership, the mandate is clear: cyber due diligence during mergers and acquisitions must match the rigorous scrutiny applied to financial audits. When organizations inherit digital infrastructure without auditing obsolete servers, unmonitored databases and applications inevitably turn into prime targets for threat actors seeking an easy corporate foothold.
“Critical Takeaways
“The 300 million dollar lesson from 2017 paid off: this time, the legacy server took the hit while the ships kept moving.
ㅤ
Darin Fredde, Senior Director and Offensive Security Evangelist, Ridge Security
“The most interesting part of this incident isn’t that Maersk was breached. It’s that the affected system was inherited through an acquisition. That’s a familiar enterprise security challenge. Companies acquire businesses, integrate operations, and sometimes inherit technology that doesn’t receive the same visibility, testing, or security attention as the rest of the enterprise. Maersk’s preliminary findings suggesting the incident was isolated and no sensitive information was disclosed are encouraging. But unauthorized access and data extraction still warrant investigation. The important questions are what the attackers accessed, how they gained entry, and whether the boundaries separating that legacy environment from other systems held. The lesson for organizations isn’t simply to replace every legacy system. It’s to know what you own, understand how inherited systems connect to the business, and continuously validate that the security controls protecting them work.
“An acquisition may close financially in a few months. The security obligations can last decades.”
Legacy systems can be a headache. You need to do your homework and make sure that this is one less headache for you.
Share this:
Like this:
Related
This entry was posted on November 11, 2026 at 4:45 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.