Logistics and shipping companies run on tightly coupled systems and partner connections, so a single intrusion can stop containers, trucks and warehouses across whole regions within hours. Carriers, freight forwarders, third-party logistics providers, terminal operators and parcel networks share bookings, customs data and tracking events through EDI, APIs and portals with thousands of counterparties, and their operations depend on operational technology in ports, warehouses and vehicles. This guide covers the threats specific to the sector, from ransomware and supply chain malware to freight fraud, the regulation that now applies (IMO guidance, IACS UR E26 and E27, the US Coast Guard cyber rule and NIS2), and the controls that matter most. It is written for security leads, IT and OT managers, and risk owners at shipping lines, forwarders, 3PLs, hauliers and port service providers. Shipboard and port terminal detail is covered in the linked maritime and ports guides; this page takes the whole-business view.
Key takeaways
- Availability is the business. Expeditors shut down most of its operating systems globally after a February 2022 attack and warned of a material adverse impact; for logistics, downtime converts directly into stranded freight and lost revenue.
- Partners are the attack surface. NotPetya reached Maersk through a compromised update of Ukrainian accounting software, and ports, forwarders and customers are connected through EDI links and portals that cross every organisational boundary.
- Regulation has arrived for the maritime side. The US Coast Guard rule (33 CFR Part 101 Subpart F) took effect on 16 July 2025, IACS UR E26 and E27 apply to ships contracted from 1 July 2024, and NIS2 covers transport and postal and courier services in the EU.
- Fraud runs through identity. Freight fraud exploits stolen carrier identities, compromised inboxes and spoofed calls to redirect loads and payments, so verification of counterparties is a security control.
- IT and OT recovery must be planned together. Terminal operating systems, warehouse automation and gate systems depend on IT services such as directories and databases; segment them and rehearse manual operation.
What makes logistics and shipping different
- Extreme interconnection: a single shipment can touch a shipper, forwarder, customs broker, ocean carrier, terminal, haulier, warehouse and consignee, each exchanging messages through EDI (often over AS2, RFC 4130, or SFTP), APIs, port community systems and web portals.
- Time-critical operations: perishable cargo, berth windows, vessel schedules and customs cut-offs mean hours of outage cascade into days of congestion. DP World Australia's November 2023 incident left almost 30,000 containers stranded at its terminals, according to local media reports cited by The Record.
- Mixed IT and OT: terminal operating systems, crane and gate automation, warehouse management and conveyor control, cold chain monitoring and vehicle telematics all sit close to corporate IT.
- Global, thin IT footprints: many small branch offices, depots and agents, often with local administrators, legacy systems and inconsistent patching.
- High-value, movable goods: cargo and payments can be stolen by manipulating data rather than breaking into a building.
Threats facing the sector
ENISA's transport threat landscape, covering January 2021 to October 2022, found ransomware rising from 13% of incidents in 2021 to 25% in 2022, with cybercriminals behind 55% of incidents and hacktivists 23%. It found no known group that targets transport exclusively, which means attacks are largely opportunistic: weak external access and unpatched systems get hit regardless of sector.
| Threat | Sector example | ATT&CK technique | Priority controls |
|---|---|---|---|
| Ransomware on core systems | Port of Nagoya, July 2023: the terminal system (NUTS) went down and container operations stopped across all terminals until restoration | T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery | Immutable backups, EDR on servers, segmented terminal systems, rehearsed manual operation |
| Supply chain malware through software updates | NotPetya, June 2017: spread through the MeDoc update mechanism, then laterally using EternalBlue (CVE-2017-0144) | T1195.002 Compromise Software Supply Chain, T1210 Exploitation of Remote Services | SMBv1 disabled, network segmentation between sites, inventory of third-party software with update rights |
| Partner and trusted-relationship compromise | Forwarders and 3PLs with access into customer and carrier systems | T1199 Trusted Relationship | Scoped partner accounts, MFA on portals, partner access reviews |
| Exposed remote access and edge devices | VPN, remote desktop and gateway appliances at depots and terminals | T1133 External Remote Services, T1190 Exploit Public-Facing Application | MFA on all remote access, KEV-driven patching, retire direct remote desktop |
| Freight fraud and business email compromise | Impersonated carriers and brokers, compromised dispatcher inboxes, changed bank details | T1566.002 Spearphishing Link, T1534 Internal Spearphishing, T1657 Financial Theft | Counterparty verification, call-back on payment changes, phishing-resistant MFA for dispatch and finance |
| Hacktivist DDoS | Booking portals, tracking sites and transport authority websites | T1498 Network Denial of Service | DDoS protection on customer-facing services, static fallback pages |
Industry reporting on freight fraud describes a consistent pattern: stolen or purchased carrier identities, compromised email inboxes, spoofed caller ID, double brokering and fictitious pick-ups. Treat carrier onboarding and load assignment as identity verification processes, not just commercial ones.
Regulation and standards
Confirm current status before relying on dates: maritime rules in particular have phased deadlines and some have been consulted on for delay.
| Regime | Applies to | Key requirements | Status notes |
|---|---|---|---|
| IMO Resolution MSC.428(98) and MSC-FAL.1/Circ.3 (Rev.2) | Ship operators under the ISM Code | Address cyber risk in the safety management system; functional elements Identify, Protect, Detect, Respond, Recover | Expected by the first annual verification of the company's Document of Compliance after 1 January 2021 |
| IACS UR E26 and UR E27 | New ships contracted for construction on or after 1 July 2024, and their onboard systems and equipment | E26: cyber resilience at whole-ship level. E27: cyber resilience of onboard systems and equipment from suppliers | Enforced through classification societies; revised versions replaced the withdrawn originals |
| US Coast Guard, Cybersecurity in the Marine Transportation System (33 CFR Part 101 Subpart F) | Owners and operators of US-flagged vessels, facilities and OCS facilities that must have security plans | Cybersecurity Officer; Cybersecurity Plan and Cyber Incident Response Plan; MFA on password-protected IT and remotely accessible OT; inventories and network maps; patch KEV vulnerabilities without delay or document compensating controls; penetration testing tied to plan renewal; two drills a year; report incidents to the National Response Center without delay | Effective 16 July 2025; training due about six months after, assessment and plan within 24 months. The Coast Guard sought comment on delaying vessel implementation by 2 to 5 years, so check for later amendments |
| NIS2 Directive (EU) 2022/2555 | Transport (air, rail, water, road) and postal and courier services above the size thresholds | Risk management measures, management accountability, supply chain security; early warning within 24 hours, notification within 72 hours, final report within one month | Applies through national transposition; see the NIS2 Directive Guide |
| Customer and contractual requirements | Forwarders, 3PLs and hauliers serving regulated customers | Security questionnaires, ISO/IEC 27001 certification, incident notification clauses | Often the main driver for smaller operators outside NIS2 scope |
For shipboard systems and port terminals in depth, see the Maritime Cybersecurity Guide and the Ports and Logistics Cybersecurity Guide.
Priority controls
Protect the core platforms
- Know the crown jewels: transport management (TMS), warehouse management (WMS), terminal operating systems, booking and tracking portals, customs filing and EDI gateways. Record for each the business process, the recovery time the business can tolerate and the manual fallback.
- Segment by site and function: NotPetya spread across a flat global network. Separate depots, terminals and warehouses from each other and from the corporate core, and isolate OT networks behind controlled conduits. See the Network Segmentation Guide.
- Patch edge and KEV first: remote access gateways and internet-facing portals get patched in days, not monthly cycles. The US Coast Guard rule makes "without delay" for KEV the expectation for covered entities.
- Backups that survive the domain: immutable copies, separate credentials, and a tested rebuild of directory services, because every application restore depends on them.
Secure partner connectivity
- EDI and API gateways: certificate-based authentication for AS2 partners, per-partner API credentials with scopes, rate limits and expiry, and an inventory of every partner connection with a business owner.
- Portal access: MFA for customer, agent and carrier portal accounts, with administrative functions such as payment detail changes behind step-up verification.
- Partner offboarding: disable credentials and certificates when contracts end. See the Third-Party Access Guide.
Counter freight and payment fraud
- Carrier verification: verify carrier identity and authority against official registers at onboarding and at each change of contact details, phone number or bank account.
- Out-of-band confirmation: confirm bank detail changes and pick-up changes through a known-good number, never contact details in the requesting email.
- Mailbox protection: phishing-resistant MFA for dispatch, booking and finance teams, alerts on new inbox forwarding rules, and DMARC enforcement on your own domains. See the Email Identity and BEC Guide.
Where identity fits
Logistics estates rely on large numbers of machine identities: EDI certificates, API keys for carriers and marketplaces, service accounts running integrations, and credentials embedded in handheld scanners, telematics units and warehouse robots. They are rarely inventoried and often shared between sites. Give each partner integration its own credential, rotate certificates before expiry, and assign every service account a named owner. See the Service Account Security Guide and the Device and IoT Identity Guide.
Implementation roadmap
- First 90 days, stop the easy entries: enforce MFA on every remote access path and portal admin; patch KEV-listed edge devices; disable SMBv1; launch a payment change call-back rule. Pilot MFA with IT and one region before global rollout, and keep a break-glass account per site under sealed control.
- Days 90 to 180, contain blast radius: segment sites and OT networks, starting with the largest terminal or warehouse; test with traffic monitoring in alert-only mode before blocking, and keep previous firewall rules for rapid rollback.
- Days 180 to 270, prove recovery: immutable backups with separate credentials; rebuild directory services in an isolated environment; run a manual-operation exercise for one terminal or warehouse, including paper gate passes and offline load lists.
- Days 270 to 365, partners and compliance: partner connection inventory, scoped API credentials and certificate expiry tracking; gap analysis against the Coast Guard rule, IACS UR E26 for new builds, or NIS2, as relevant.
- Year 2, measure and improve: report the metrics below to the board, extend EDR and logging to all branches, and test incident response jointly with key partners.
Decision guidance
| Question | Smaller forwarder, haulier or 3PL | Global carrier, terminal operator or large 3PL |
|---|---|---|
| Where to start | MFA, patching, backups and payment verification; use a managed detection service | Segmentation of the global network and OT, partner connectivity governance, 24x7 SOC |
| Hosted TMS or WMS versus on-premises | SaaS reduces patching load; demand contractual incident notification and data export | Mix of both; treat SaaS tenants and integration credentials as part of the estate |
| Regulatory driver | Customer contracts and questionnaires, possibly NIS2 if above thresholds | Coast Guard rule, IMO and IACS for fleets, NIS2 across EU operations |
| OT approach | Vendor-managed equipment with controlled remote access | Dedicated OT security programme aligned to IEC 62443 and IACS UR E27 for vessels |
The main trade-off is speed of partner onboarding against verification. A frictionless onboarding process is what freight fraudsters exploit, so accept some delay for new carriers and changed payment details.
Detection and measurement
Monitor identity provider sign-ins, VPN and remote access logs, EDI gateway authentication failures and new partner endpoints, privileged group changes, backup deletions, email forwarding rules and east-west traffic between sites. In OT zones, alert on new remote sessions and engineering workstation activity outside maintenance windows.
- Remote access MFA coverage: percentage of remote access paths and portal admin accounts with MFA enforced.
- KEV exposure time: median days from KEV listing to remediation on internet-facing systems.
- Segmentation coverage: percentage of sites and OT zones separated from the corporate core with enforced rules.
- Recovery readiness: critical platforms with a successful restore or manual operation exercise in the last 12 months.
- Partner credential hygiene: partner connections with a named owner and a credential or certificate expiry date.
- Fraud prevented: payment or pick-up change requests stopped by out-of-band verification.
Framework mapping
| Control area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Inventory of systems, software and partner services | ID.AM-01, ID.AM-02 | CM-8 System Component Inventory |
| Segmentation and remote access | PR.IR-01 | SC-7 Boundary Protection, AC-17 Remote Access |
| Authentication and access | PR.AA-03, PR.AA-05 | IA-2, AC-2 |
| Supply chain and partner requirements | GV.SC-05, GV.SC-07 | SR-3 Supply Chain Controls and Processes, SA-9 External System Services |
| Backups and recovery | PR.DS-11, RC.RP-03 | CP-9 System Backup |
| Monitoring | DE.CM-01 | CA-7 Continuous Monitoring |
Common failure patterns
- Flat global networks: NotPetya moved from one infected entry point across Maersk's estate; Maersk restored users and applications in stages across 500 locations and estimated the impact at $200 million to $300 million in its Q2 2017 interim report.
- Single shared terminal or operating system with no manual mode: at Nagoya, one terminal system outage halted container operations across all terminals.
- Unverified counterparties: carrier onboarding and payment detail changes accepted by email without out-of-band confirmation.
- Partner credentials that never expire: EDI certificates, API keys and portal accounts left active after contracts end.
- Branch offices outside the security programme: local admin rights, unmanaged devices and old remote access at depots.
- Remote vendor access to OT without control: always-on connections to cranes, conveyors and building systems. See the OT Remote Access Guide.
Lessons from incidents
The sector's major incidents share a pattern: the damage came from how far and how fast the disruption spread, not from the initial foothold. Expeditors chose to shut down most systems worldwide to contain its 2022 attack, DP World Australia's incident was declared nationally significant by Australia's National Cyber Security Coordinator, and Maersk's recovery depended on rebuilding at scale. The investments that would have reduced impact were segmentation, isolated backups of identity infrastructure, and practised manual operation. The Storm-0501 Hybrid Cloud Attacks 2024, which Microsoft reported against US transportation organisations among others, show how the same weak account protection now carries attackers from on-premises networks into cloud tenants.
Practitioner checklist
- List core platforms (TMS, WMS, terminal, booking, customs, EDI) with tolerable downtime and a tested manual fallback for each.
- Enforce MFA on all remote access, portals and email, with phishing-resistant methods for admins, dispatch and finance.
- Patch KEV-listed vulnerabilities on internet-facing systems without delay and disable SMBv1 everywhere.
- Segment sites, OT zones and the corporate core, and broker all vendor remote access into OT.
- Keep immutable backups with separate credentials and rehearse a rebuild of directory services.
- Inventory every partner connection, credential and certificate with an owner and an expiry.
- Verify carriers at onboarding and confirm every payment or pick-up change out of band.
- Map obligations under the Coast Guard rule, IMO guidance, IACS UR E26 and E27, or NIS2, and track deadlines.
- Exercise incident response jointly with key partners and with operations staff, not only IT.
Standards and references
- IMO: Maritime cyber risk
- US Coast Guard (Federal Register): Cybersecurity in the Marine Transportation System
- IACS: UR E26 and E27 press release
- EUR-Lex: Directive (EU) 2022/2555 (NIS2)
- ENISA: Understanding Cyber Threats in Transport
- NIST: Cybersecurity Framework 2.0
- CISA: Known Exploited Vulnerabilities Catalog
- US SEC: Expeditors International Form 8-K, March 2022
Related NHI Mgmt Group resources: Maritime Cybersecurity Guide · Ports and Logistics Cybersecurity Guide · OT Security Guide · Third-Party Risk Management Guide · Ransomware Prevention Guide. This guide summarises regulatory regimes that apply to logistics and shipping and is not legal advice.