---
title: "Maersk legacy-system data theft"
description: "Maersk confirmed data extraction from an acquired legacy system and said customer operations were expected to continue normally."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-13"
canonical_url: "https://www.ally.security/incidents/maersk-legacy-system-data-theft-2026"
markdown_url: "https://www.ally.security/incidents/maersk-legacy-system-data-theft-2026.md"
stix_url: "https://www.ally.security/incidents/maersk-legacy-system-data-theft-2026/stix.json"
---

# Maersk legacy-system data theft

Maersk confirmed data extraction from an acquired legacy system and said customer operations were expected to continue normally.

Last modified Nov 13, 2026 · 1 source

## Summary

- **Environment:** Local legacy system inherited through an acquisition
- **Operational impact:** No customer disruption anticipated in the advisory
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Maersk](https://www.maersk.com/) confirmed unauthorized access and data extraction from an acquired legacy system in its [November 11, 2026 advisory](https://www.maersk.com/news/articles/2026/11/11/it-security-incident). [1](#source-1)

## Impact

Maersk said preliminary findings strongly suggested no sensitive data had been disclosed. It found no indication of impact to other Maersk systems or customer and partner integrations. These were interim findings during an ongoing investigation. [1](#source-1)

## Timeline

### November 11, 2026 — Legacy-system data theft disclosed

The advisory did not identify the attack or discovery date. [1](#source-1)

### November 13, 2026 — Briefing updated

This briefing was last reviewed and updated on November 13, 2026.

## Threat Group & Attack Vector

The affected acquisition, precise system and entry method were not identified in the advisory.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific ATT\&CK technique is mapped from the available evidence.

## Response

Maersk secured the affected system and launched an investigation. It did not anticipate customer operational disruption and said booking and shipment-management services could continue normally. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/maersk-legacy-system-data-theft-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Maersk IT security incident advisory

official · A.P. Moller - Maersk · Nov 11, 2026

<https://www.maersk.com/news/articles/2026/11/11/it-security-incident>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Affected Organization · 100% confidence · current**  
   Maersk legacy-system data theft: A.P. Moller - Maersk
2. **Occurred At · 100% confidence · current**  
   Legacy-system data theft disclosed: 2026-11-11
3. **Disclosed At · 100% confidence · current**  
   Maersk legacy-system data theft: 2026-11-11
4. **Resulted In · 100% confidence · current**  
   Maersk legacy-system data theft: Maersk secured the affected system and launched an investigation that remained ongoing at its November 11 advisory.
5. **Resulted In · 100% confidence · current**  
   Maersk legacy-system data theft: Maersk confirmed unauthorized access and data extraction from a local legacy system inherited through a previous acquisition.
6. **Resulted In · 100% confidence · current**  
   Maersk legacy-system data theft: Preliminary findings strongly suggested no sensitive data had been disclosed, according to Maersk. It found no indication of impact to other Maersk systems or customer and partner systems connected through APIs or EDI.
7. **Resulted In · 100% confidence · current**  
   Maersk legacy-system data theft: Maersk did not anticipate customer operational disruption and said booking and shipment-management platforms could continue to be used normally.
8. **Resulted In · 100% confidence · current**  
   Maersk legacy-system data theft: Legacy-system data theft disclosed

</details>