Unknown – Maersk (unverified claim)

On 7 November 2026, ransomware incident trackers indexed a Whitearmor leak-site post naming Maersk and alleging theft of data from its contract-logistics platform. The post claimed approximately 100 GB of data and demanded a ransom. These are the threat actor's allegations, not independently verified facts: no corroborating confirmation from Maersk or independent reporting was found. Ransomware.live labels Whitearmor an emerging group and cautions that this claim needs independent verification. The post describes data theft and extortion; it does not establish that Maersk systems were encrypted. The date above is the date the listing was observed, not a confirmed intrusion date.

• Ransomware.live — Maersk / Whitearmor listing (indexes the claim and warns it is unverified)
• RedPacket Security — Whitearmor ransomware victim: Maersk (automated summary of the leak-site claim; not independent confirmation)