Organized Crime Behind Surge in Freight Cyberattacks, Study Finds

Summary

Proofpoint Research finds organised criminal groups are using phishing, fake load-board listings and legitimate remote monitoring and management (RMM) tools (ScreenConnect, SimpleHelp, PDQ Connect) to take over trucking and freight company systems, hijack shipments and reroute goods for sale. Researchers have observed nearly two dozen campaigns since August 2025 affecting carriers from small family firms to large logistics operators. Losses are substantial: the National Insurance Crime Bureau estimates cargo theft at around $34 billion annually, with thefts rising 27% in 2024 and a further 22% expected in 2025.

Key Points

Criminals use phishing and compromised load boards to install legitimate RMM tools and gain remote access to carrier systems.
Attackers bid on or reroute legitimate shipments, enabling large-scale cargo theft and resale—often overseas or via online marketplaces.
Proofpoint observed almost two dozen cyber-enabled cargo-theft campaigns since August 2025, affecting carriers of all sizes.
Most incidents have been reported in North America, with activity also noted in Brazil, Mexico, India, Germany and South Africa.
Commonly stolen goods include food and beverages (energy drinks are frequently targeted); estimated annual cargo-theft losses are around $34bn.
Proofpoint recommends restricting unapproved RMM tools, monitoring network activity, verifying load-board listings and training staff to spot phishing.

Content summary

The report explains how digital transformation—beneficial for operations—also gives organised criminals new tools. Attackers exploit the urgency of freight booking and carriers’ eagerness to accept loads, using that speed to push malicious links or pose as brokers. Once inside systems they can place bids, change routing and arrange thefts with little immediate detection.

Proofpoint stresses this is a co-ordinated, lucrative trend tied to organised crime, with ripple effects across ports, carriers, warehouses and consumers. Without stronger technical and human controls, the firm expects cyber-enabled cargo theft to continue increasing.

Context and relevance

This matters to logistics managers, fleet operators, procurement and risk teams: cybercrime has moved from data theft to enabling physical theft at scale. The findings connect to broader supply-chain cyber trends and illustrate how traditional crime adapts to digital tools, increasing financial, operational and reputational risk across the sector.

Why should I read this?

Quick and blunt — read this because your shipments, margins and reputation could be next. It’s a short, practical heads-up on what criminals are doing and what you can do right now to make it harder for them. We’ve done the legwork so you can act faster.

Author’s take

Punchy: This is a wake-up call. Tighten controls on RMM tools, verify load boards and train dispatch teams — otherwise organised gangs will treat logistics as their business model.