Shipping giant Maersk, whose vessels and terminals handle a large share of Africa’s container trade, has confirmed that an unauthorised party accessed and extracted data from a local legacy system it inherited through an earlier acquisition.
Maersk said its investigation so far “strongly suggests” no sensitive information was disclosed, and that the incident was isolated to that one system. The company reported no impact on its other systems, on customer and partner integrations such as APIs and EDI, or on shipment bookings, according to the CyberSecBrief daily briefing.
A group calling itself WhiteArmor is demanding $5 million, BleepingComputer reported. Maersk has not confirmed an extortion demand or said what data was taken, so the claim remains unverified (CyberSecBrief).
Why old systems matter
The Maersk incident highlights a common weak spot: systems that come with an acquisition and are never fully absorbed into the parent company’s security controls. For African banks, fintechs and telecoms that grow by buying smaller rivals, the lesson is to inventory and secure inherited systems quickly, or shut them down.
Six flaws under active attack
The US Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities catalogue this week, based on evidence of active exploitation. They affect Cisco BroadWorks, Barracuda products including Email Security Gateway, Openwave Messaging Webtop Media Transcoder, Microsoft Outlook and Google Chromium (CyberSecBrief). Organisations using these products should patch as a priority.
IT providers in the crosshairs
- ScreenConnect: ConnectWise is investigating a campaign in which compromised ScreenConnect environments were used to push rogue remote-access clients to customer devices, affecting managed service providers and dozens of organisations.
- N-able: the company released hotfixes for its N-central remote monitoring platform after zero-day flaws were disclosed publicly, forcing it to take vulnerable hosted environments offline.
- Stolen AI keys: Railway said AI provider keys stored by customers were stolen in an October breach and used to run up an estimated $740,000 in unauthorised charges.
All three were reported by CyberSecBrief.
What to do now
Security teams should patch the CISA-listed flaws, review who has remote-management access to their networks, rotate any API keys stored on third-party platforms, and set spending limits on AI and cloud accounts. Small businesses that rely on an outside IT provider should ask that provider directly whether it uses ScreenConnect or N-central and what it has done this week.
