Maersk detects data extraction from legacy system, says operations continue
Key Facts
On November 11, Maersk said it had detected unauthorized access to and data extraction from a legacy on-premises system dating to a previous acquisition, in an incident it described as isolated from its other systems. The company said its cybersecurity team launched a full investigation as soon as the incident was discovered, and the investigation is ongoing alongside measures to secure the affected system. Available findings so far, the company said, strongly suggest that no sensitive data was exposed. It also said it had found no indications that other Maersk systems or connected customer and partner systems were affected. This preliminary assessment limits the scope of the reported impact, while the investigation into the incident and data extraction continues.
Maersk said the incident was confined to an on-premises system and that it had found no impact on customer and partner systems connected through API and EDI interfaces. This clarification matters to the company’s customers, who use its platforms to manage shipments: Maersk said they can continue booking and managing shipments as usual. It added that it does not currently expect disruption to customer operations. That assessment is based on the company’s preliminary findings, while the investigation has not yet concluded. Maersk pledged to keep customers informed of relevant information as it becomes available. It also said it would notify affected parties if the investigation’s findings show that is necessary.
As a precaution, the company advised customers to treat any unexpected communications claiming to be related to the incident with caution and verify them through their usual Maersk contact. The advice comes as the company continues to examine the on-premises system where unauthorized access and data extraction occurred. The company did not identify in its statement how the system was accessed or who was responsible. It also did not disclose the number of records or people whose data may have been included in what was extracted. Those questions remain subject to the ongoing investigation, along with whether specific parties need to be notified.
The incident brings Maersk’s record of cyberattacks back into focus, although the company describes the current incident as isolated to a legacy on-premises system. In its 2017 annual report, it said the NotPetya attack disrupted transport and logistics operations and affected customers, with losses at the time estimated at about $250 to $300 million. In its 2017 quarterly update, it said the impact was concentrated mainly in Maersk Line, APM Terminals and Damco. After the attack, the company said it had implemented and planned initiatives to strengthen cyber resilience, IT service continuity and recovery, and had purchased cyber insurance to mitigate some of the potential financial impact of future attacks. That history does not establish a link between the 2017 attack and the incident disclosed in November 2026, which Maersk describes as confined to an on-premises system.
The cybersecurity disclosures come days after a financial update in which Maersk raised its 2026 annual guidance. On November 5, the company raised its full-year underlying EBITDA guidance range to $14.0–14.5 billion, from $10.5–12.5 billion previously, and raised its underlying operating profit guidance to $8.0–8.5 billion, from $4.5–6.5 billion. It also reported that group revenue in the third quarter rose 27% year over year to $18.1 billion. EBITDA was $4.7 billion, compared with $2.7 billion in the third quarter of 2025. For the stock, EL7 data showed AMKBY closing at $14.47 on November 10, compared with a close of $14.93 on November 9; both were daily closes before the company’s November 11 statement.