Critical

Maersk confirms data breach as WhiteArmor ransomware demands $5 million

BleepingComputer

November 11, 2026 at 4:24 PM

Actively Exploited

Overview

Maersk has confirmed a data breach after a threat actor accessed a legacy system that the company acquired in a previous purchase. The hackers extracted sensitive data from this system and are demanding a ransom of $5 million in exchange for not releasing the information. This incident raises concerns about how well companies safeguard inherited systems, especially those that may not be fully integrated or updated. The breach could have significant implications for Maersk's operations and reputation, as well as for partners and clients who rely on the company's logistics services. The situation is still developing, and the company is likely assessing the full impact of this breach.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Local legacy system acquired through earlier acquisition
Timeline: Newly disclosed

Original Article Summary

Maersk announced that a threat actor gained unauthorized access to a local legacy system inherited through an earlier acquisition and extracted data from it. [...]

Impact

Local legacy system acquired through earlier acquisition

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Not specified

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Ransomware, Data Breach.

Read Original Article

Related Coverage

N-able Takes N-central Platform Offline After Discovery of 33 Flaws

darkreading

N-able has taken its N-central platform offline after discovering 33 security flaws, including several that are classified as zero-days. These vulnerabilities could allow attackers to take control of systems using the platform. In response to the threat, N-able has released a hotfix to help mitigate the risks associated with these flaws. This situation is significant as it affects users relying on the N-central platform for remote monitoring and management, raising concerns about the security of their systems. Companies using this platform should apply the hotfix as soon as possible to safeguard against potential exploitation.

Nov 11, 2026

Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation

The Hacker News

Zoom has issued software updates to fix two security vulnerabilities in Zoom Workplace for Windows, including a critical flaw identified as CVE-2026-108186. This vulnerability has a high severity score of 9.6 and involves improper input validation, which could allow an unauthenticated user to gain elevated privileges on affected systems. Users of Zoom Workplace for Windows should update their software promptly to protect against potential attacks that exploit this vulnerability. The existence of this flaw raises concerns about the security of user data and system integrity, making it crucial for organizations to stay vigilant and ensure their applications are up to date.

Nov 11, 2026

eBPF Rootkits: Why Underground Actors Are Taking Notice

BleepingComputer

Researchers have found that Linux eBPF rootkits are gaining traction among cybercriminals, who are utilizing these advanced techniques to conceal malicious activities on systems without needing to load traditional kernel modules. This method allows attackers to evade detection by conventional security measures. The information is being actively shared in underground forums, where hackers are posting source code, tutorials, and exploits specifically targeting Linux environments. This development is concerning for organizations that rely on Linux systems, as the ability to hide harmful actions makes it significantly harder for security teams to identify and respond to intrusions. As these rootkits become more prevalent, companies using Linux must enhance their security protocols to defend against these stealthy threats.

Nov 11, 2026

N-able releases security hotfixes for zero-day vulnerabilities

BleepingComputer

N-able has released hotfixes to address serious zero-day vulnerabilities in its N-central remote monitoring and management (RMM) platform. These vulnerabilities were publicly disclosed over the weekend, prompting the company to take affected hosted environments offline to mitigate potential risks. Users of the N-central platform should apply these hotfixes promptly to secure their systems against possible exploitation. The situation emphasizes the importance of timely updates in the face of emerging security threats, as attackers often seek to exploit newly discovered vulnerabilities. This incident serves as a reminder for organizations using this platform to remain vigilant and proactive in their cybersecurity practices.

Nov 11, 2026

Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords

The Hacker News

A recent security review by Claroc revealed that over 35,000 apps built using the Grok platform were publicly accessible without any sign-in requirements. Out of 37,571 apps examined, 35,578 were found to be open, including 24 developed by employees of X, the social media network, and SpaceXSI, the company behind the Grok AI assistant. While many of these apps were benign, such as games and calculators, approximately 10% contained sensitive internal business data, raising serious concerns about data exposure. This incident highlights a significant risk for companies that may unintentionally expose confidential information through poorly secured applications. Organizations using Grok-built apps need to take immediate action to secure their applications and protect user data.

Nov 11, 2026

We Built An Agent That Broke All of Our Security Rules. Here's What We Learned.

The Hacker News

Token, a company focused on AI agents, built a new agent that inadvertently violated its own security rules regarding identity, access control, and traceability. This agent operated using a user's authenticated browser session, exposing potential risks associated with AI integration. The team at Token realized that these oversights could lead to significant security vulnerabilities, prompting them to rethink their defensive strategies for AI agents. This incident serves as a cautionary tale for companies developing similar technology, emphasizing the need for strict adherence to security protocols to prevent unauthorized access and data breaches. As AI continues to evolve, ensuring robust security measures is crucial for safeguarding user information.

Nov 11, 2026