Whoever has you, has your clients.

In this sector, time decides

Consignment, window, contractual penalty — whatever slows the flow loses. In that calculation security is almost always the item that comes last and is dropped first: the certificate to be replaced next week, the interface to be secured later, the driver's account left open after they moved on. None of these decisions was made wrongly. They were made under time pressure, and they accumulate.

What we find

Database and logistics systems whose interfaces have run unchanged for years and hand over data in the clear. Encryption is the exception, and where it is missing it is replaced by other constructions — an additional network, a restriction to address ranges, a hop across a server everyone knows. Virtual desktops are in use, but who opens which session there, and what it is allowed to reach, is rarely something anyone can survey. Where an EDR does exist, it delivers alerts to a place where nobody works through them.

At mid-sized and smaller forwarders, even that is unlikely. There is a firewall and antivirus, and that is where it ends.

This matches what ENISA describes in its threat landscape for the transport sector: attacks overwhelmingly hit IT and administration — booking, billing, customer data — rather than control technology. Ransomware leads by a wide margin, followed by data theft.

The provider is the route to the client

This sector's greatest exposure is not its own house but its position. Whoever has the logistics provider has effectively everything: what a client orders, what it ships, to whom, in what quantity, at what price and on what date. The attack does not take the route through the sender or the recipient — it takes the route through the party both of them trust, and then keeps using that trust.

That shifts the actual task. It is not only to fend off an attack, but to be able to demonstrate to clients that no access took place and no data left. A company that cannot do this loses the contract even when nothing happened.

That the target is not always the data itself is shown by the port of Antwerp: between 2011 and 2013, attackers acting for a smuggling ring gained access to the systems of two container terminals in order to change the collection times and locations of prepared containers and pick them up ahead of the legitimate carrier. The attack was aimed at the IT; the haul stood in the yard.

How far the outage reaches when the systems themselves are hit is documented too. In 2017 NotPetya brought down the global IT of one of the largest shipping lines, with terminals in more than a hundred countries out at once. An Australian logistics group was hit twice within months in 2020 by different groups, the second time with contracts and employee data exfiltrated. A globally active freight forwarder shut down most of its worldwide operations in February 2022 and was constrained for around three weeks — by its own statement without the ability to arrange shipments or handle customs.

The existing estate cannot carry this

Structures that were common on networks twenty years ago do not answer the question the client is asking. A firewall and antivirus say nothing about who accessed what, and when.

How to get out of it

Interfaces get an identity. Every data handover to clients, carriers and platforms runs authenticated and encrypted, with named counterparts instead of permitted address ranges.

Access gets an end. Subcontractors, drivers and external dispatchers get access for a period, not in perpetuity. The most common finding is the account left open after someone moved on.

The virtual desktop becomes a controlled zone. What a session may reach and what may leave it is defined and recorded, rather than assumed.

One source of truth. Identities, rights and states live in one place and under version control. Without it, the assurance given to a client stays an assertion.

Evidence instead of assurance. Access to consignment and customer data is logged and summarised, so that the question "did anything leave your systems" can be answered with a document.

Where it pays to start

A survey of the interfaces and of external access, before anything is procured. In this order: which systems exchange data in the clear today and with whom; who has access from outside and since when; what a session in the virtual desktop is allowed to reach; and whether it could be shown, for the last twelve months, who accessed which client data.

Sources: ENISA Transport Threat Landscape, March 2023; the BSI Act, Annex 1, as amended by the German NIS2 implementation act; BSI-KritisV § 9 with annex 7. Incidents per contemporaneous reporting and, in the freight forwarder's case, the company's own statement.