Cargo theft has gone digital. Rather than breaking in, thieves are invited in through spoofed carrier emails, fraudulent load postings, and compromised broker or carrier accounts, and they often spend weeks or months building legitimacy before striking. In April 2026, the FBI warned that threat actors were using spoofed emails, fraudulent URLs, and compromised accounts to post fake loads, accept genuine shipments, and redirect freight for resale. Estimated 2025 US and Canada cargo theft losses reached roughly US$725M, with losses up 60% from 2024, confirmed incidents up 18%, and the average value per theft up 36% to $273,990.
The attack chain begins as an identity and workflow attack and ends in a physical loss: attackers compromise accounts, impersonate trusted parties, manipulate loads and documents, acquire real freight, divert it, and monetize it. A single stolen load disrupts operations, triggers disputes and claims, exposes partner data, and erodes trust, so the impact reaches well beyond the IT team. No single function can prevent this fraud. The CIO/CTO owns identity, data, architecture, and detection, while Operations owns workflow controls and frontline verification.
CIOs should align controls and accountability across the threat lifecycle: prevent and detect through MFA, identity and access management, email security, and monitoring; validate and contain through partner vetting, multichannel verification, secure pickup and release, and shipment holds; and recover and learn through an integrated incident playbook, evidence preservation, partner notification, and coordination with insurers, legal, and the FBI. Embed these controls in dispatch, TMS, carrier onboarding, and warehouse release workflows so staff can verify an exception quickly without bypassing security under operational pressure.
