Before the truck moves: how cybercriminals are rewriting cargo theft

Cargo theft used to mean stealing freight in transit. Now it starts before the truck moves. Criminal groups no longer just target freight, they’re targeting the systems, credentials and digital identities that control how freight moves.

The numbers reveal the impact. In Germany a truckload vanishes every three days, largely due to a surge in phantom carrier fraud. Across the Atlantic, in the US and Canada, estimated losses from cargo theft climbed to nearly $725 million in 2025, a 60% jump from 2024. The average loss per incident rose by more than a third as criminals shifted focus to higher-value shipments.

The job isn’t just physically protecting facilities and fleets; it’s also about securing the digital connections that move freight.

The dual threat: How cybercrime and freight fraud converged

Cybercriminals have professionalised, with specialised groups taking on distinct roles across phishing, access brokering, ransomware deployment and monetisation. Freight fraudsters are evolving in the same way: building shell companies, cloning legitimate carriers and forging credentials. 

The modern cargo thief often begins as a cyber intruder, a shift that’s reflected in ENISA's 2025 Threat Landscape report, which ranks transport as the second most targeted sector in the EU, with ransomware responsible for more than 80% of incidents. 

Compounding the problem is the rapid increase in AI-driven attacks, with  one in six breaches now involving AI. A compromised login at a freight platform can be used to hijack load boards, reroute shipments or divert payments. By the time anyone realises what has happened, the goods have slipped across a border.

This is what makes the threat so difficult to manage. The same attack often starts in the digital layer, but plays out physically, with stolen credentials used to secure and reroute real-world freight. These attacks succeed because the transport ecosystem remains fragmented, with data and workflows spread across disconnected systems. 

Why traditional defences are failing

Fragmentation isn't just an operational headache; it's a security liability. Disconnected systems create data silos, leaving organisations with no shared visibility and no early warning when something goes wrong. Traditional, reactive cybersecurity approaches are struggling to keep pace with increasingly sophisticated and automated adversaries.

European regulators are formalising what the industry is already seeing, because attacks no longer target a single company. They exploit weak points across interconnected networks, where one compromised system could potentially expose an entire supply chain. 

Under NIS2, essential and important entities must now integrate supply chain security into their core risk management, including the vulnerabilities of suppliers, service providers and extended partner networks.

EU cybersecurity guidance goes further, emphasising that a supplier doesn't have to be frequently attacked to be a critical risk. If its compromise would have serious consequences downstream, it's a liability. One failed vendor could disrupt thousands of shipments.

In a connected transport network, resilience can't be built in isolation. It has to be shared and standardised across the ecosystem.

The right kind of connected

More connections aren’t the problem. Connections without clear governance are. In practice, network-level visibility can turn a single detected irregularity into a warning for the whole ecosystem, while shared identity frameworks and continuous carrier vetting directly counter phantom carrier fraud.

AI-powered monitoring tools analyse network behaviour in real time to flag unusual routes, suspicious logins and unexpected load changes – for example, when a carrier profile changes suddenly, or a shipment is reassigned at the last minute. But for AI-powered monitoring to be effective, those signals need to trigger clear action, so that when something looks wrong, it can be verified or stopped before the load moves, with human oversight remaining essential for interpreting and acting on them. Security needs to be designed into operational workflows from the start, not layered on retroactively. 

What resilience looks like

At their core, mature, secure ecosystems are built on three things: verified identity and access, continuous monitoring and shared intelligence. 

Identity means continuously vetting carriers and partners – not just at onboarding – and double-checking any payment or delivery changes through a separate channel. Much of this still comes down to people, who remain the single biggest vulnerability in any security framework. Training and awareness remain critical, as many breaches still begin with compromised credentials or simple human error.

Monitoring means real-time visibility across the network, with anomaly detection at a speed that human oversight can't match, so that even when attacks succeed, the right controls are in place to contain and recover quickly.

Shared intelligence means threat data flowing across the ecosystem, so that one detection point protects the whole network, not just the operator or system that caught the anomaly. 

None of these work in isolation, of course. But together, they form the core architecture of a resilient supply chain – built internally and reinforced through shared platforms and trusted partners.

From fragmented systems to collective resilience

Security is no longer just about protecting the perimeter; it’s about securing the entire supply chain network. The companies that lead in this new threat landscape will be those operating within connected ecosystems that turn fragmented data into collective intelligence, built on automated vetting and clear governance. 

That kind of resilience doesn't happen on its own. If your systems can't share a major threat signal across your supply chain network the moment it's detected, it's time to rethink the foundation.