For: shippers, freight forwarders and partners who use Maersk for booking, shipment management and invoicing, and operators that hold legacy systems from acquisitions. This article is an explainer based on Maersk's official statement and does not cover attack steps.
Developing: this article will be updated as the organisation publishes more
- Who is affected
shippers, freight forwarders and partners who use Maersk for booking, shipment management and invoicing, and operators that hold legacy systems from acquisitions.
- Confirmed so farSee the table ↓
- Unauthorised access
- Data extraction
- Customer operations
- Not yet confirmed
- The types and number of records extracted (not stated)
- The final findings of the investigation (the company says it is ongoing)
- Whether impacted parties will be contacted individually (the company says it will if it identifies a need)
1 more
- The cause and the date of discovery (not stated)
- What to do nowSee the steps ↓
- Verify unexpected messages about this incident with your usual contact
- Check requests to change payment details against a known channel
- Watch your API and EDI integrations for anything unusual
2 more
- Take updates from your usual contact and the official notice
- Operators: review your own legacy systems
- Where to verify (source)All sources ↓
- Maersk, "IT security incident" (official notice; November 11, 2026; checked November 12)
- Last checked
- As of November 12, 2026
Follow-up plans and what we checked
The company says it will keep customers updated as more relevant information becomes available, and will inform impacted parties if it identifies a need to. When we checked on November 12, 2026, we found nothing newer than the November 11 statement.
What customers and partners should do today
Verify unexpected messages about this incident with your usual contact
The company asks customers to treat unexpected communications claiming to relate to this matter with caution and to verify them through their usual Maersk contact. Use a contact you know from your contract or past dealings, not the details in the message. See What phishing is.
Check requests to change payment details against a known channel
The statement says no more than that its findings strongly suggest no sensitive data has been disclosed; the extracted data is not described. Counterparty and invoice information can be used to make convincing requests, so do not act on a change of bank details, a replaced invoice or an urgent transfer request until you confirm it by phone or another channel you already know (our view).
Watch your API and EDI integrations for anything unusual
The company says it found no indication of impact on connected customer and partner systems, and the statement contains no request to rotate credentials. As a precaution, check your side's integration logs for unfamiliar calls or a rise in failures (our view).
Take updates from your usual contact and the official notice
The company says it will keep customers updated and points questions to the local Maersk representative. The official notice is the statement linked in the sources below.
Operators: review your own legacy systems
The points to check if you hold legacy systems from acquisitions are in "What operators of legacy systems should review" below.
What happened (from Maersk's statement)
This section is based on Maersk's official notice "IT security incident" (November 11, 2026). It is the company's own account and has not been verified by a third party.
Date of discovery
Not stated. After the company's cyber security team discovered the issue, a full investigation was launched immediately and is ongoing (November 11 statement).November 11
The company publishes its notice, saying there was unauthorised access and data extraction from one of its local legacy systems from a previous acquisition.
- What happened
- Unauthorised access and data extraction from one of its local legacy systems from a previous acquisition
- The company's response
- A full investigation was launched immediately after discovery; swift action was taken to secure the affected system
- Data
- Findings so far strongly suggest no sensitive data has been disclosed. The types and number of records extracted are not stated
- Scope
- The incident is isolated to a local system. No indication of impact on other Maersk systems or on customer and partner systems that connect through APIs and EDI
- Operations
- No disruption to customer operations is anticipated at this time; customers can book and manage shipments as usual
- Guidance to customers
- Treat unexpected communications claiming to relate to this matter with caution and verify them through your usual Maersk contact. Questions go to the local representative. Impacted parties will be informed if a need is identified
What is known and what is not
The state as of November 12, 2026. We will update the status column when more is published.
| Item | Content | Status |
|---|---|---|
| Unauthorised access | One local legacy system from a previous acquisition | Confirmed (the company) |
| Data extraction | Data was extracted | Confirmed (the company) |
| Sensitive data | Findings so far strongly suggest none was disclosed | Under investigation |
| Other Maersk systems | No indication of impact | Not confirmed (the company) |
| Customer and partner systems connected through APIs and EDI | No indication of impact | Not confirmed (the company) |
| Customer operations | No disruption anticipated; booking and shipment management as usual | Confirmed (the company) |
| Types and number of records extracted | Not stated | Not stated |
| Cause and date of discovery | Not stated | Not stated |
| Claim of responsibility by a third party | The statement does not mention it. A claim has been reported but is not confirmed by the company | Not stated |
| Final findings | Investigation ongoing | Under investigation |
How to read this: the wording "strongly suggest" is not a guarantee
"Findings so far strongly suggest no sensitive data has been disclosed" is the result of the investigation to date and not a statement that no data of concern was taken. Because the extracted data is not described, it is also unknown what the data that is not called "sensitive" includes. A third party's claim of responsibility is not covered in this article because the company has not confirmed it.
What can happen when counterparty information is taken
The following is what can generally happen, not a statement that any of it has occurred here. What the company says has occurred is limited to "What happened" above.
Shipper and partner names, contact details for staff, and shipment or invoice information make it possible to craft convincing fake invoices and requests to change payment details. Shipping involves many parties and a lot of paperwork, so an unfamiliar message is harder to tell from a real one. That is why checking through your usual contact, as the company asks, works well.
What operators of legacy systems should review
This section does not assess the company's response and does not speculate about technical details. Starting from the disclosed fact that the system was one of the company's local legacy systems from a previous acquisition, it limits itself to points to check in your own setup, as our view.
Put systems inherited through mergers and acquisitions into your inventory
Legacy systems that have not been integrated often fall out of the main asset register and monitoring. List what runs where, who owns it and what data it holds (our view).
Separate them from the main environment and from customer integrations
The company says the incident was isolated to a local system, with no indication of impact on other systems or integrations. Keep legacy systems apart from the main network, authentication and API and EDI links so a breach does not spread (our view).
Do not leave data you no longer need on them
Check whether old customer and partner data remains on unused systems, and delete or move what is not needed. Data you do not hold cannot be taken (our view).
Apply the same logging and monitoring as new systems
Old systems often have weak logs and detection. Watch outbound traffic and large reads of data to the same standard as the main environment so extraction is noticed early (our view).
Set a retirement date
Shut down systems that are no longer used by a set date. If one cannot be shut down yet, decide and record the extra protection that applies in the meantime (our view).
Sources (public records)
The facts in this article come from the public information below. Attack step details are not covered.
- Maersk, "IT security incident" (official notice; November 11, 2026; checked November 12) — maersk.com
Update history
2026-11-12: First version. Based on Maersk's official notice (November 11). A third party's claim of responsibility is not covered because the company has not confirmed it. We will update when more is published.
Read next
- A logistics operator's data breach: The Yamato Transport and Sagawa Express data breaches
- Spotting fake messages: What phishing is / What ransomware is
- Other 2026 incidents: Data breaches and cyberattacks of 2026