The Threats You Don’t See on the Highway

Anyone who has moved freight for a while knows cargo theft didn’t start last year. It used to look like a trailer cut from a lock at a truck stop. Now it looks like a stolen dispatcher login, a convincing phone call with enough details to establish trust, a fake pickup order that matches the real one down to the formatting, or a load board account sending carriers a “rate confirmation” with malware attached. The theft is still physical. The break-in is digital.

I’ve spent my career in technology across several industries, and I’ve watched cybercrime evolve in each of them. Looking back, 2013 and 2014 were the turning points. Ransomware as a concept had been around since the early nineties, but the risk was latent. Before it was  industrialized in the 2010s, the threats we faced, viruses, denial-of-service attacks, were disruptive and sometimes destructive, but the business model behind them was thin. Ransomware started monetizing the harm directly. What began as extortion turned into a criminal economy where stolen data, banking credentials, and access to compromised systems became assets to be bought and sold. The defining trend of the last decade hasn’t been the growth of cybercrime so much as the industrialization of how it’s paid for.

Freight is now feeling the full weight of that economy. Criminal groups operate globally, pick their targets with precision, and increasingly use AI to produce emails, documents, and even voices good enough to fool experienced people. The fakes are better and harder to spot, and the losses per incident keep growing. Industry researchers often report that attacks on logistics companies have risen by nearly tenfold since 2021. Criminal groups figured out that it’s easier to hijack a bid than a truck.

Why are freight and supply chains a target

Our industry runs on trust and speed, and the freight is valuable. A dispatcher gets a call from someone who sounds like a broker they’ve worked with for years. A customer emails updated banking details for their remittance. A driver gets a text with a revised delivery address. In a business where minutes matter and relationships carry weight, those interactions work because people trust them. Attackers noticed.

They also noticed how connected we’ve become. Telematics, ELDs, TMS platforms, Cloud, EDI, API, customer portals, customs brokers, load boards. Each one makes freight move faster, and each one is a potential door. The most damaging incidents lately often start at a vendor or a partner and spread from there.

What we protect, and why it matters to you

When I think about cyber risk at Bison, I think about two things.

The first is data. Our customers trust us with shipment details, contracts, pricing, and contacts. Our employees and drivers trust us with their personal information. That trust is why people do business with us and why they work here. Protecting it is a basic obligation.

The second is continuity. A cyber incident at a carrier doesn’t stay on a screen. It stops dispatch, blinds visibility, delays billing, and strands freight and drivers. For a shipper, it looks like a blizzard, except there’s no forecast. Our job is to make sure that, if something happens, and it eventually can happen to everyone regardless of size, customer freight keeps moving, and you hear it from us first.

How we think about it

I won’t lay out our controls here; that would be a gift to the wrong audience. But I can tell you how we approach the problem.

We assume we’re a target. Not because we’re special, but because everyone in this industry is, and planning from “when” rather than “if” is the only honest starting point.

We treat verification as a habit rather than an insult. If a request comes in to change banking details, reroute a load, or reset an account, we don’t act on the email or the call we’re looking at. We call back on a number we already trust. The same applies when someone reaches out to one of our staff, because caller ID is one of the easiest things to fake. Trust but verify. Good partners understand that a callback is respect, not suspicion. If we ever slow you down by a few minutes to verify a request, it’s for that reason.

We build in layers and expect some of them to fail. No single tool, vendor, or policy holds the line on its own. The goal is to make sure one mistake never becomes a catastrophe.

We practice. Incident response is people who know what to do at 2 a.m. on a Saturday because they’ve rehearsed it. Recovery time is decided in advance, not discovered during the event.

And we hold our partners to the same standard. Third-party risk is the story of this decade. We ask hard questions of the partners and platforms we depend on, and we welcome our customers asking the same of us.

What hasn’t changed

The technology behind these attacks is new. The instinct behind them is not. Someone is trying to get you to trust something you shouldn’t, and the defense is just as old-fashioned: slow down when something feels off, and call back on a number you trust.

For any shipper, I’d offer three things. Confirm any changes to payment or pickup instructions with someone you know. Ask your carriers and brokers how they manage cyber security and fraud, how they’d tell you about an incident, and how fast. And treat your own team’s awareness as part of your supply chain, because attackers do.

None of us will be perfect. But the carriers and shippers who perform the best won’t be the ones who never faced a threat. They’ll be the ones who prepared honestly, communicated early, and never lost sight of the point: the freight has to get there.