The FBI says cyber-enabled cargo theft hit $725 million in 2025. The attack chain is the same one security teams see in phishing and BEC every day: spoofed domains, compromised accounts, impersonated identities. The difference is the outcome. This time, the thing being stolen is a truck.
When the FBI published a public service announcement warning that cyber-enabled strategic cargo theft had reached an estimated $725 million in losses across the United States and Canada in 2025, the details it described were familiar to anyone who tracks phishing and business email compromise for a living. Threat actors gain access to a legitimate broker or carrier’s systems through spoofed emails and fake URLs, then use that compromised identity to conduct transactions the real company never authorized. In financial services, the stolen asset is a wire transfer or a session token. In logistics, it is a truckload of electronics or pharmaceuticals, physically redirected and resold before the real carrier knows its name was used. The FBI Philadelphia field office noted that high-tech strategic cargo thefts have soared 1,500% since 2021.
The PSA is worth reading outside the logistics industry not for the dollar figure, which is substantial enough on its own, but for what the attack chain reveals about how brand impersonation scales across sectors. The technique documented in the advisory is the same playbook security teams encounter in credential theft and BEC every week, applied to a domain where the stolen asset weighs several tons and cannot be recovered with a password reset.
How the scheme works
The operation starts where most impersonation attacks start: with a phishing email.
The FBI describes threat actors sending spoofed emails disguised as broker agreements, service review requests, or routine vendor correspondence to employees at freight brokers and carriers. The emails contain links that install remote monitoring and management tools, giving the attacker persistent access to the victim’s systems without the victim knowing anything has changed. From there, the attacker operates inside a legitimate business identity.
With that access, the operation unfolds in two parallel tracks. On one, the attacker floods trucking load boards, the digital marketplaces where shippers, brokers, and carriers connect, with tens of thousands of fraudulent listings posted under the compromised carrier’s name. Legitimate carriers bid on these fake loads and contact the attacker, who provides malicious broker agreements that compromise the carrier’s systems in turn. The infection spreads through the industry’s own transaction infrastructure.
On the other track, the attacker uses the compromised identity to bid on real shipments. Posing as the legitimate carrier, they accept loads, then double-broker them to partially unwitting drivers with manipulated bills of lading and altered delivery destinations. To slow investigation, they update the legitimate carrier’s contact information with the Federal Motor Carrier Safety Administration and modify insurance records. The cargo is redirected, transferred to complicit drivers, and stolen for resale. In some cases, the attackers demand ransom to reveal the shipment’s location.
The FBI took the unusual step of naming a specific group. Diesel Vortex has operated 52 phishing domains since at least September 2025, impersonating freight brokers and carriers through spoofed email domains and fake websites. Reporting indicates the group uses AI-generated emails and deepfake voice impersonation of known dispatchers to make their communications indistinguishable from routine business correspondence.
Why this is the same playbook in a different industry
Strip away the logistics-specific language and the attack chain is identical to what the cybersecurity industry documents in credential theft and business email compromise. A phishing email delivers the initial access, a compromised account provides the trusted identity, and that identity is used to conduct fraudulent transactions that the victim’s counterparties have no reason to question because the communications come from what appears to be a known and verified business partner. The documentation is altered to match the fraud, and the stolen value, whether it is a wire transfer, a session token, or a truckload of electronics, leaves before anyone realizes the identity was compromised.
The National Motor Freight Traffic Association has separately warned that the digital-to-physical theft pipeline is now “unmistakable,” with cyber intrusion routinely preceding or directly enabling the physical theft of freight. The American Trucking Associations estimates that total annual cargo theft costs the U.S. economy up to $35 billion when undetected and unreported incidents are factored in.
For security teams outside the logistics industry, the relevance is not the cargo. It is the proof that brand impersonation scales across sectors and outcomes, with the impersonated brand as the constant and the stolen asset varying by industry.
What this means for brand protection
The FBI’s recommendations to the logistics industry read like standard social engineering defenses translated for a different audience: verify shipment requests through a secondary channel, do not use contact information provided in the original request, enforce multi-factor authentication across load board accounts and email, audit third-party carrier credentials before engaging.
But the PSA also describes something that brand protection teams in every industry should recognize. The impersonated companies in these schemes did not know their identities were being used until the freight was gone. Their carrier accounts were compromised, their FMCSA records were altered, and their names were attached to fraudulent transactions they never authorized. The first sign of the impersonation was often a call from a confused driver or a missing shipment, not a security alert.
That gap between impersonation and detection is not unique to logistics. It is the same gap that exists whenever a brand’s name, domain, or credentials are used in a context the brand has no visibility into. The freight industry’s load boards are this sector’s version of the internet’s phishing infrastructure: a marketplace where identity is asserted rather than verified, and where a convincing impersonation is indistinguishable from a legitimate participant until something goes wrong.
The Bottom Line
The FBI’s cargo theft PSA is not a logistics story. It is an impersonation story that happens to involve trucks. The attack chain, from phishing email to compromised identity to fraudulent transaction, is the same playbook documented across financial services, healthcare, technology, and every other sector where an attacker can borrow a trusted name to authorize something the real owner never approved. The $725 million in losses and 60% year-over-year growth reflect what happens when that playbook reaches an industry where identity verification has historically been informal and where the stolen asset cannot be recovered with a password reset. For any organization whose brand could be impersonated in a transaction its counterparties would trust, the cargo theft surge is a preview, not an exception.
Key Takeaways
The FBI estimates $725 million in losses across the U.S. and Canada in 2025, a 60% increase over 2024. Confirmed incidents rose 18%, and the average value per theft reached $273,990. High-tech strategic cargo thefts have soared 1,500% since 2021.
Phishing emails compromise broker or carrier accounts. Attackers use those identities to post tens of thousands of fraudulent listings on load boards and to accept real shipments under stolen carrier identities. Cargo is redirected to complicit drivers and resold. Documentation and federal registration records are altered to cover the fraud.
The attack chain is identical to credential theft and business email compromise: phishing delivers initial access, a compromised identity conducts fraudulent transactions, and the victim’s counterparties have no reason to question communications from what appears to be a verified partner. The impersonated brand is the constant across sectors. The stolen asset varies.
A threat group the FBI named publicly in the PSA, which has operated 52 phishing domains since September 2025 targeting freight brokers and carriers. The group reportedly uses AI-generated emails and deepfake voice impersonation of known dispatchers.
The impersonated companies did not know their identities were being used until the freight was gone. The gap between impersonation and detection is the same gap that exists whenever a brand’s name is used in a context the brand has no visibility into. Monitoring for unauthorized use of your identity, whether on a phishing page or a freight board, is the same operational requirement.
