Logistics & Supply Chain. Everyone's supplier. Therefore everyone's breach surface.

Logistics is everyone's supplier. A single ransomware attack on a single freight forwarder produces consequences across hundreds of unaffiliated commercial customers.

The logistics and supply-chain threat landscape is the threat landscape that compounds every other sector. Logistics operators sit at the structural junction between manufacturers, retailers, governments, and end consumers — and the data, processes, and operational continuity they manage are the connective tissue of the contemporary economy. The threat actors targeting them have understood this for years; the regulatory and architectural responses are only now catching up.

The 2024 incident calendar reads as a catalogue of cascading supply-chain consequence. The August 2024 JAS Worldwide ransomware attack disabled the company's C1 central operations system and customer-facing JAS SmartHub portal for several days — preventing customers globally from tracking shipments in real time, despite the underlying cargo continuing to move. The September 2024 Transport for London (TfL) attack exposed bank account details of approximately 5,000 passengers and required 30,000 employees to attend in-person password resets. The August 2024 Port of Seattle Rhysida ransomware attack disrupted Sea-Tac International Airport for three weeks. The March 2024 Ward Transport & Logistics DragonForce attack exfiltrated 574 GB of internal data. The 2023 KNP Logistics Akira attack drove the UK haulier into insolvency. [01]

The 2017 NotPetya attack on A.P. Moller-Maersk remains the canonical reference for cascading supply-chain consequence at scale. Initially propagating through compromised Ukrainian accounting software, the malware ultimately produced shutdown of 76 Maersk port terminals and disruption to over 45,000 PCs and 4,000 servers, with estimated direct losses to Maersk of USD 300 million. Customer organisations dependent on Maersk-routed shipments absorbed billions in additional consequence. The attack was not aimed at logistics — but logistics absorbed the consequences. [02]

Logistics-sector attack vectors concentrate in transport-management, freight-forwarding, and distribution-centre systems.

The same vectors recur across investigations: ransomware against shared transport-management systems used by shippers and customers; supply-chain compromise of freight-forwarder portals; phishing exploitation of less-than-truckload carrier dispatchers; vendor-channel compromise propagating into customer-operations data.

TSA Pipeline. EU NIS2. Australia SOCI. The cybersecurity perimeter of logistics is no longer a private matter.

The US Transportation Security Administration issued cybersecurity Security Directives for higher-risk passenger-rail and rail-transit owner-operators starting in 2022, and has progressively extended these obligations across road-freight, pipeline, and aviation modalities. The CISA Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) — when its final rule takes effect — will impose 72-hour reporting obligations on covered transportation and logistics entities for substantial cyber incidents.

The EU NIS2 Directive (effective 18 October 2024) brings logistics within "essential entity" or "important entity" cybersecurity-governance and incident-reporting obligations, depending on operator size and criticality. The Critical Entities Resilience Directive (CER) imposes parallel physical-resilience obligations.

For Australia, the Security of Critical Infrastructure Act 2018 was extended in 2022 to include the freight-services and freight-infrastructure sectors. The 2023 DP World Australia incident demonstrated the operational consequence; the regulatory consequence followed.

The Federal Maritime Commission, the US Department of Transportation, and equivalent bodies internationally have begun referencing cybersecurity expectations in their licensing and operational-authority frameworks. The IMO Resolution MSC.428(98) requires incorporation of cyber risk management into the International Safety Management Code for ocean-going vessels and operating companies.