Danish shipping company Maersk said threat actors gained access to a “legacy system from a previous acquisition,” but said the incident does not impact other parts of the firm.

The incident affecting Maersk, one of the largest shipping companies in the world with a 2025 revenue of $54 billion, is the latest in a string of attacks on ports and other shipping organizations worldwide. Brazil’s largest port was hit with ransomware last week and is still struggling to restore systems through Thursday.

Maersk said its findings suggest no sensitive data has been disclosed, and it does not anticipate disruptions for customers. “The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI,” the company said.

Maersk provided few details on the attack but the statement came three days after the WhiteArmor ransomware gang claimed it attacked LF Logistics. The Hong-Kong based transportation and logistics company was acquired by Maersk in 2022. 

The ransomware gang claimed it stole 100GB of data from LF Logistics and demanded $5 million in 30 days. The stolen data allegedly includes information on LF Logistics drivers, warehouses, customers and more. 

Maersk, which has previously dealt with ransomware affecting company systems as well as specific port operations, is not the only shipping organization to be dealing with a cyber incident.

An attack on Brazil’s Santos Port Authority — one of the largest in South America — began last Friday and caused a power outage, eventually leading to significant delays in loading and unloading cargo while also forcing officials to conduct route scheduling and billing services manually.  

The Santos Port Authority said on Thursday that it has been able to recover about 70% of its systems through backups. Brazil’s Federal Police are now investigating the attack. 

Ports in the U.S., Europe and Asia have been repeatedly targeted by ransomware gangs over the last five years as many shift to incorporate digital operations. In 2024, the Port of Seattle refused to pay a ransom to cybercriminals that caused issues at the city’s airport and seaport ahead of the Labor Day holiday.