Fleet Cybersecurity in 2026: Protect Freight and Dispatch

Blog post – By Securing Your Business

A fake load listing and a request to install a document viewer can put a dispatch computer—and the company accounts on it—at risk. These five checks help owners protect freight, payments, and day-to-day operations.

Why fleet cybersecurity matters in 2026

A fake load listing can lead to a request to install remote-access software. Proofpoint has documented campaigns using this approach against trucking and logistics companies. If an attacker gains access to a dispatch computer or account, freight instructions, payment details, and operations may be at risk.

NMFTA's 2026 industry report flags AI-assisted social engineering, misuse of legitimate access tools, and third-party software dependencies. Other transportation guidance stresses the basics: protect freight records, know what equipment and services connect to your systems, and limit access to what each one needs.

CargoNet estimated nearly $725 million in cargo-theft losses across the United States and Canada in 2025, an 18% increase in confirmed incidents from 2024. Those figures cover cargo theft broadly—not losses caused specifically by cyberattacks. The FBI has separately warned that criminals compromise broker and carrier accounts to impersonate legitimate businesses and arrange fraudulent freight movements.

For an owner, the practical questions are who can change a load or payment, which vendors can reach your systems, and how dispatch will keep working during an outage.

Protect the accounts that can move freight or money

List your business email, load boards, transportation management system (TMS), telematics, banking, factoring, fuel-card, and FMCSA-related accounts. For each, record who has access, who can recover it, and who removes access when a worker leaves. Avoid shared dispatch passwords.

Require multifactor authentication (MFA) for people who can approve payments, administer accounts, or change carrier information. Where supported, ask your provider about passkeys or security keys. Keep a current user list, note any MFA exceptions, and review access for former employees and outside dispatchers.

CISA: Require multifactor authentication

Verify changes before the load or payment moves

A familiar name or an ongoing email thread does not authorize a change. Set a callback rule for new delivery locations, substitute carriers or drivers, bank or factoring details, and account-recovery information.

Call a number already in your records—not one supplied with the request. Record who asked, who verified and approved the change, and when. Dispatchers should be able to pause an urgent request they cannot confirm.

FMCSA recommends checking broker and carrier phone numbers through SAFER, investigating discrepancies, examining documents, and matching the arriving truck to the contracted carrier. Keep the approved shipment instructions and a record of changes. If tracking conflicts with a driver's report or receiver confirmation, stop and verify through known contacts.

FMCSA: Broker and carrier fraud and identity theft

Control remote access to dispatch computers

Remote-support software is useful when your IT provider needs to fix a problem. Criminals have also used legitimate remote-management tools in freight-related campaigns. A familiar software name does not prove that an installation request is authorized.

Require approval through your normal support process before anyone installs software or grants remote control. Ask your IT provider to list approved tools, restrict who can install them, check for unauthorized tools, and explain how vendor access is removed.

Practice with dispatch: an agreement link prompts an installation. Staff should know to stop, report it, and verify the sender. If an unexpected installation or remote session occurs, report it promptly instead of trying to quietly undo it.

Joint Guide to Securing Remote Access Software

Find out what your vendors and integrations can access

Your TMS may connect to telematics, accounting, customer portals, and other services. Create a one-page register showing each provider, the data and actions it can access, and who can disconnect it.

Ask vendors how their staff access your account, which other services connect to your data, whether permissions can be limited, whom to call after hours, how they will notify you of an incident, and what information you can retrieve during an outage. Get answers about your account, not just a general security statement.

Include electronic logging devices, driver apps, and fleet-connected equipment. Record who manages accounts and updates, and what happens to devices when trucks are sold or reassigned. Ask which functions can be changed remotely and whether office and vehicle systems need to connect. A connected device is not necessarily exposed or compromised; confirm its actual access paths before deciding what to fix.

Test whether dispatch can operate through an outage

Losing access to dispatch records, customer email, or billing can stop a load even if no truck is affected. CISA recommends protected backups, restoration tests, and incident-response preparation. Ask when your last recovery test took place, what was restored, and how long it took.

Then ask the team: email and the TMS are down at 7 a.m., and loads are already moving. How will you:

Identify active loads, drivers, and confirmed destinations.
Reach drivers, customers, and vendors using protected contact records accessible without business email.
Verify urgent instruction changes through an agreed alternate process.
Preserve shipment and delivery records for later reconciliation.
Decide which work can safely continue and which must pause.

A fleet owner's first-week checklist

Assign an owner to each check. The business owner can set transaction rules; your IT provider can supply technical evidence.

Accounts: review users, MFA, recovery access, and former staff. Keep a dated list and record open exceptions.
Freight and payments: write down how to verify and approve changes. Keep one example of the process in use.
Remote support: list approved tools, who can install them, and how vendor access is removed.
Vendors: document connected services and after-hours contacts.
Dispatch continuity: practice an email-and-TMS outage. Record recovery-test results and assign follow-up work.

Sensitive freight can bring an additional targeting risk

A May 2025 joint advisory announced by CISA described Russian military intelligence targeting Western logistics and technology organizations, including those coordinating or transporting assistance to Ukraine. It does not mean every domestic fleet faces the same threat.

If you handle sensitive international movements, ask your security provider to review relevant advisories, customer requirements, and monitoring needs alongside everyday account and cargo-fraud controls.

CISA: Joint advisory on Russian GRU targeting of Western logistics and technology organizations

If you suspect an account or load has already been compromised

Call your IT responder and the affected platform using established contact details. Confirm active freight instructions directly with the real parties. Preserve messages, shipment records, account alerts, and a timeline; let responders guide containment and account recovery.

If money was sent, call the bank immediately. For suspected cyber-enabled cargo theft, report it to local police and follow the FBI's IC3 guidance. Follow your incident plan for insurer and other notifications.

As of October 11, 2026, Reginfo listed the CIRCIA final rule as pending regulatory review, received October 1. That listing does not establish an effective reporting obligation for every fleet. Ask your adviser to confirm applicable legal, contract, and insurance duties.

Know which safeguards you can prove

Know who controls your accounts, how staff verify consequential changes, and how dispatch will recover if a critical system fails.

The Business Security Baseline independently reviews agreed safeguards such as email protection, Microsoft 365 access, devices, backups, and incident-response planning. Discuss dispatch systems and vendor dependencies when setting scope. It does not automatically include connected-vehicle testing, a full TMS assessment, or incident forensics.

Business Security Baseline

Give your team a practical way to spot freight scams

Each enrolled employee gets one private email link to a short weekly challenge, with practical feedback and participation records. Transportation scenarios are included. Plans start at $49/month.

Explore Security Awareness Training