Transportation & Logistics — Cyber Threat Activity

Transportation and logistics is attacked for what it moves, not only for what it earns. Our log records more than 650 incidents across 69 countries, over 180 in the trailing 180 days, with 68 groups attributed at least one claim: Qilin (68), Cl0p (60), Akira (58), Play (46) and LockBit (39) lead. Three separate threat models converge here. The first is ordinary extortion against carriers, freight forwarders and third-party logistics firms, where a halted dispatch system strands physical cargo and the clock is measured in demurrage. The second is fraud that uses network access as its instrument rather than its objective: the FBI reported cyber-enabled strategic cargo theft surging to nearly $725 million in estimated US and Canadian losses in 2025, executed by compromising broker and carrier accounts, bidding on genuine loads, then re-brokering them with altered paperwork and diverting the shipment. That attack leaves an IT incident and a missing truck, and it is frequently misfiled as one or the other. The third is state espionage. CISA and allied agencies attributed a sustained campaign by Russian military intelligence unit 26165 against Western logistics entities coordinating aid into Ukraine, including the use of internet-exposed cameras near border crossings and rail stations to watch materiel move. Recorded geography is United States-led at 267 claims, then Canada, the United Kingdom, Germany, France and Brazil. Treat these as extortion-site claims rather than confirmed breaches, and note that the cargo-theft and espionage activity above largely does not generate leak-site posts at all, so the count understates the sector's real threat picture by design.

All sectors

Recent incidents

Threat actors targeting Transportation & Logistics

Where these victims are

Malware used against Transportation & Logistics

Families used by the threat actors that target this sector, derived from actor tooling rather than observed in these incidents directly.

Coverage. 92.8% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.

Read the full analysis on IntelFusions