11/12/2026
Everyone is talking about the $5 million extortion attempt against Maersk.
That's not the most interesting part of the story.
The real lesson is that cyber risk doesn't stop at your perimeter. It doesn't stop after an acquisition. And it certainly doesn't disappear because a system isn't considered "core" to the business.
According to reports, the compromised environment was tied to a system inherited through a previous acquisition. While Maersk stated the incident appears isolated and there is currently no indication of broader operational impact, the event is a reminder that attackers don't care about organizational charts. They look for the weakest path to valuable data.
Too many organizations treat M&A cybersecurity as a point-in-time exercise:
✔️ Perform due diligence
✔️ Integrate the company
✔️ Move on
Attackers see it differently.
Every acquired application, legacy platform, forgotten database, and exception that remains in the environment becomes part of your attack surface. The longer those systems exist outside modern security controls, the more attractive they become.
The uncomfortable truth:
Cyber resilience is no longer about protecting what you built.
It's about securing everything you inherited.
Security leaders should be asking:
• Which acquired systems still operate outside our standard controls?
• Where are legacy identities, privileged accounts, and unmanaged credentials hiding?
• How quickly can we discover and contain an incident in an environment that wasn't originally ours?
The companies that win in cybersecurity aren't the ones with the biggest security budgets.
They're the ones that refuse to let yesterday's acquisition become tomorrow's headline.