NMFTA’s 2026 Report Highlights Cyber-Enabled Cargo Theft and Data Extortion Risks
Report discovered via Awesome Annual Security Reports.
Summary
NMFTA’s 2026 transportation cybersecurity report links credential compromise and social engineering to cargo theft, warns of shared-vendor risks, and anticipates greater reliance on data theft for extortion rather than encryption.
Key points
- The report identifies social engineering as transportation’s leading risk in 2025, with compromised email, carrier accounts, and dispatch systems enabling fraudulent pickups, shipment diversions, and payment fraud.
- NMFTA describes increasingly specialized criminal operations in which access brokers, social engineers, ransomware operators, and monetization teams collaborate across the intrusion lifecycle.
- The report documents a shift toward data theft for extortion and anticipates that trend continuing in 2026; attackers also manipulate shipping records to facilitate theft or increase pressure on victims.
- Shared SaaS providers, cloud integrations, and insecure APIs create concentration risk, allowing a single vendor compromise to expose multiple downstream fleets and brokers.
- Attackers abuse legitimate remote administration tools, including AnyDesk and ScreenConnect, while AI-generated phishing, forged documents, and voice impersonation strengthen deception.
- GPS spoofing and insecure telematics expand physical-asset risks, but the report states that no attacks specifically targeting trucks in the wild had been publicly disclosed.
- Recommended safeguards include role-based awareness training, out-of-band verification, MFA, network segmentation, administrative activity monitoring, immutable backups, and coordinated cyber and physical security.
Article Details
- Publisher
- National Motor Freight Traffic Association, Inc. (NMFTA)
- Report Period
- 2025 review and 2026 outlook
- Scope
- Cybersecurity, cyber-enabled cargo crime, and operational resilience in the North American transportation sector, particularly trucking.
- Key Statistics
- CargoNet reported $111.88 million in cargo theft claims in Q3 2025; the report cautions that widespread underreporting limits visibility into total cargo crime.
- The report cites year-over-year cargo theft increases of 110% in New Jersey and 33% in eastern Pennsylvania in its discussion of Q3 2025.
- ReliaQuest reported that average breakout time, from initial compromise to lateral movement, fell to 18 minutes by the end of Q3 2025.
- More than 80 active ransomware brands were recorded globally by late 2025; the report states that dozens targeted transportation companies or their vendors.
- In several incidents discussed by the report, exploitation was detected within 24 hours of vulnerability disclosure, before vendors published patches.
- Recommendations
- Provide role-based, scenario-based social engineering training, including verification of pickup authorizations, digital identities, and payment instructions through out-of-band channels.
- Segment critical systems and administrative networks; require MFA for remote sessions and enforce role-based, attribute-based, and privileged access controls.
- Restrict remote management tools through strict access controls, prevention of unauthorized installations, and continuous administrative activity logging and monitoring.
- Apply secure-by-design API practices, secure or replace legacy APIs, protect API credentials, and continuously assess cloud configurations and third-party vendor risk.
- Maintain immutable backups, data-exfiltration detection, and tested recovery capabilities within a coordinated cybersecurity, operational security, and physical security program.
MITRE ATT&CK
T1078 · Valid AccountsAttackers used stolen or purchased credentials to access carrier portals, dispatch systems, load boards, and other operational applications.T1199 · Trusted RelationshipThe report describes attackers compromising trusted vendors and integration partners to obtain indirect access to connected carriers and brokers.T1204 · User ExecutionClickFix campaigns tricked employees into copying malicious commands presented as troubleshooting steps; helpdesk impersonators also persuaded employees to install malicious support software.T1219 · Remote Access ToolsAdversaries weaponized legitimate remote access and management tools, including AnyDesk and ScreenConnect, for remote malicious activity and lateral movement.T1486 · Data Encrypted for ImpactRansomware operators encrypted business-critical data, including data accessed directly through SMB shares.T1565.001 · Stored Data ManipulationAttackers altered dispatch orders, shipping records, bills of lading, and other digital records to facilitate fraud, cargo theft, and extortion.T1566 · PhishingAttackers used phishing to harvest credentials, compromise transportation accounts, and facilitate cargo theft.T1595.002 · Vulnerability ScanningAttackers used automated scanners to identify exposed APIs, misconfigured cloud storage, and unpatched systems across potential victims.T1656 · ImpersonationCriminals impersonated dispatchers, brokers, IT helpdesk personnel, managers, and executives, including through AI-generated voice calls.
Threat Actors
AkiraNamed as a ransomware actor engaged to perform data exfiltration, encryption, and extortion within specialized criminal operations.ClopNamed as a ransomware actor engaged to perform data exfiltration, encryption, and extortion within specialized criminal operations.LockBitThe report links its decline and fragmentation to the emergence of smaller ransomware operations and describes affiliates participating in specialized attack roles.PlayNamed as a ransomware actor engaged to perform data exfiltration, encryption, and extortion within specialized criminal operations.RansomHubThe report identifies its decline and fragmentation as contributing to the proliferation of smaller ransomware operations in 2025.Salt TyphoonCited as evidence of nation-state probing and access to national critical infrastructure; the report notes limited instances of direct transportation-sector targeting.Scattered SpiderIdentified as specializing in social engineering; the report cites ReliaQuest intelligence describing joint operations with ShinyHunters.ShinyHuntersIdentified as exploiting cloud-based CRM systems and collaborating with Scattered Spider; the report describes customer-data exfiltration through a compromised Salesforce integration.Volt TyphoonCited as evidence of nation-state probing and access to national critical infrastructure; the report notes limited instances of direct transportation-sector targeting.