A.P. Moller – Maersk said in an advisory dated 11 November 2026 that it has identified an IT security incident involving unauthorised access and data extraction from one of its local legacy systems from a previous acquisition.

Maersk says its investigation is ongoing and that its findings so far strongly suggest no sensitive data has been disclosed.

It says the incident is isolated to a local system and that it has found no indication of impact on other Maersk systems or on customer and partner systems that connect to Maersk through integrations such as APIs and EDI.

Maersk says it does not anticipate disruption to operations, that customers can continue to book and manage shipments as usual, and that it will inform impacted parties if it finds a need to. It tells customers to treat unexpected communications claiming to relate to the incident with caution and to verify them through their usual Maersk contact. (source: Maersk)

According to BleepingComputer (11 November), Maersk did not share details about the affected system, the compromised data types or when the intrusion occurred, and had not answered BleepingComputer's further questions by publication. (source: BleepingComputer)

Correction (12 Nov 2026): this card repeated a ransomware group's leak-site claims (a ransom demand, a claimed data volume and the platform it named); those claims came only from the group, not from Maersk or an independent confirmation, and have been removed. (source: BleepingComputer, which attributes them to the group)