Two tractor-trailers loaded with tequila left Jalisco bound for Pennsylvania. The route was predetermined, the trucks were equipped with GPS and video surveillance cameras, and the logistics provider’s operations center was receiving updates on their journey. Everything seemed to be under control, even when a delay notification arrived accompanied by a video that supposedly showed a breakdown.
However, while the system reported that the units were moving toward their destination in the United States, the merchandise was actually being transported to a warehouse in Los Angeles, where it would be stolen. The email, the video, and the GPS signal were all fake.
The case illustrates a type of theft that is changing the rules of transport security: it is no longer essential to intercept a truck on the road when it is possible to digitally manipulate the information that allows it to be tracked.
“They deceive you and suddenly your merchandise is not where it is, and you don’t even realize it because you are receiving the signal that everything is in order,” explained Manuel Rivera, Founder and CEO of NEKT Group, during a cybersecurity conference aimed at the logistics sector.
During the Breakfast Meeting of the National Council of Executives in Logistics and Supply Chain (ConaLog) , the specialist pointed out that these types of incidents demonstrate that supply chain security no longer depends exclusively on physical security personnel, operators, and protocols. Today, it is also contingent upon the integrity of emails, tracking platforms, digital identities, and the systems that connect the various participants in an operation.
Cargo theft begins on a computer
One of the risks Rivera outlined is the impersonation of carriers, a practice in which criminals first gain access to a company’s email account and then use that identity to participate in legitimate logistics operations.
The scheme can begin with a freight offer posted on a marketplace. An interested carrier receives a confirmation email and downloads a file that appears to contain documentation to formalize the service. However, the document installs malware that allows the attacker to remotely access their computer and take over their account.
Once inside, the criminal can use that carrier’s identity to bid on other legitimate loads, communicate with clients, and arrange pickups. Thus, when a truck arrives at a distribution center with seemingly correct tracking numbers and identification information, the merchandise can end up in the hands of someone who was never hired.
The operation combines two dimensions: first, digital deception to appropriate an identity; then, the physical execution of the theft through an apparently legitimate collection.
Rivera identified five types of fraud that pose risks to logistics companies: impersonation of carriers, double intermediation, changing bank accounts, urgent orders from managers, and falsification of tracking data.
In cases of double intermediation, a contractor may resell a trip to a nonexistent third party or one that is not authorized to operate the service. In other scenarios, criminals intercept communications and divert a vehicle during its journey.
Changing bank accounts also poses a direct threat to administrative areas. An email seemingly sent by a supplier might request that future payments be deposited into a new account. If this instruction isn’t verified through other means, the money could end up in the hands of attackers.
According to Rivera, in the United States and Canada, losses of $725 million were recorded in 2025 related to these cargo theft schemes, while fictitious pickups have shown accelerated growth.
Rivera has a simple answer to the question of why a logistics company would be targeted by a cybercriminal: it’s because it has assets to protect that can be turned into money for the attackers.
The specialist identified four elements that make organizations attractive: money, reputation, information, and operational continuity.
In logistics, these four assets are closely related. An intrusion can lead to theft of merchandise, misappropriation of payments, exposure of contracts and tariffs, or even the disruption of systems necessary to receive, store, transport, and deliver products.
Information also has strategic value. Routes, costs, contracts, customers, and rates can all become business intelligence for competitors or other parties interested in understanding how a company operates.
Rivera explained that some attackers seek to obtain information silently, without demanding a ransom or disrupting operations. Their goal is to remain inside systems for extended periods to extract data that they can later use or sell.
Others, however, seek to block systems and demand money in exchange for restoring access . This method, known as ransomware, can paralyze everything from administrative processes to the operation of loading docks and distribution centers.
“Today, we are all potential victims for cybercriminals,” he noted.
The threat isn’t limited to large corporations either. A small transportation company can become the gateway to compromising a larger organization, especially when there’s a constant exchange of documents, emails, access, and data between the various links in the chain.
Artificial intelligence: faster at deceiving
Added to this scenario is artificial intelligence (AI) , which has reduced the resources and technical knowledge needed to carry out certain attacks.
Rivera explained that commercially available tools allow you to create much more convincing emails, mimic the writing style of an executive, clone voices, and even generate videos that simulate meetings or instructions from real people.
During his presentation, he cited the case of a company where a finance employee received a transfer request attributed to the finance director. Due to his doubts, the employee requested a video conference to confirm the instruction.
At the meeting, five colleagues supposedly appeared, their images and voices sounding authentic. However, they were all AI-generated recreations. Convinced the request was legitimate, the worker made 15 transfers totaling $25 million.
The case shows that traditional validation mechanisms, such as recognizing a voice, a photograph, or even seeing a person in a video call, are no longer sufficient to guarantee the authenticity of an instruction.
In the logistics sector, this advance can translate into fake emails to confirm shipments, requests to change bank accounts, or instructions apparently issued by operations managers.
Furthermore, AI allows for the automation of investigations into potential victims and the personalization of messages to make them more credible, thus expanding the scale of attacks.
For Rivera, the main change is that criminals can investigate and attack multiple companies at a much lower marginal cost than before.
The risk also lies with the technology providers
Beyond fraud related to goods and payments, the specialist drew attention to a threat that is gaining relevance as industrial and logistics operations move towards automation: attacks on industrial control systems.
Historically, many plants and production systems operated in isolation. However, the incorporation of connected technologies, sensors, and remote monitoring tools has expanded the possibilities for control and efficiency, but also the areas of exposure.
Today, systems that manage refrigeration, energy, water, oil pipelines, gas pipelines, and manufacturing processes can be connected to digital platforms.
Rivera presented the case of an attack on the software of a supplier company that managed supermarket refrigeration systems. The criminals did not directly access the retail chains, but rather compromised the third party responsible for controlling the equipment.
The example helps to illustrate the risk of technological dependence: a company can have its own security protocols and still be exposed by the vulnerabilities of a supplier that manages a critical component of its operation.
“Today, we need to know who that person or those people are,” Rivera warned, referring to technology providers who, although not always visible to senior management, may have access to systems essential to maintaining operations.
This scenario places third-party risk management among the top priorities for companies. Supplier evaluations should no longer be limited to their operational, financial, or compliance capabilities, but should also include their digital access, the systems they manage, and the protocols they use to protect information.
Three questions to safeguard the operation
Given this scenario, Rivera suggested that prevention does not necessarily begin with large technological investments, but rather with reviewing the daily procedures that authorize the movement of money, goods, and information.
Among his recommendations, he highlighted the use of a keyword to validate extraordinary instructions between managers and employees, as well as establishing a second communication channel to confirm sensitive transactions.
He also proposed involving at least two people in processes such as changing supplier bank accounts: one to receive the instruction and another to validate and execute the transaction.
Multi-factor authentication , robust protection of corporate email, and verification of the identity of carriers, operators, and units are other measures that can reduce exposure.
An additional validation process may seem bureaucratic, but the cost of omitting it can result in lost merchandise, diverted payments, or shut-down facilities.
Digitalization has enabled companies, carriers, warehouses, and suppliers to connect within a single operational network. However, this interconnectedness also means that a seemingly small vulnerability can compromise much larger links.
In this context, cybersecurity is no longer just a matter for the IT department: it is a condition for ensuring that cargo reaches its destination, that payments reach the correct accounts, and that the supply chain continues to function.
Comment and follow us on LinkedIn: @Jennifer Galindo / @GrupoT21
