Is Your Brokerage a Cyber Target?
Content for this blog came from the TIA Livestream Is Your Brokerage a Cyber Target? What Transportation Leaders Need to Know.
The big picture: The most dangerous cyber threats facing freight brokers right now are not sophisticated technical attacks. They are fraud schemes designed to exploit the everyday workflows your team runs on autopilot.
That reframe set the tone for a recent TIA live stream on cybersecurity in brokerage, featuring Chris Snyder of Logistiq Insurance Solutions, Laszlo Gonc of Next Transformation Group, and Jerry Morsovillo of ILG Logistics. The through line across the entire conversation was simple: this is a business problem, not an IT problem.
How brokers are actually getting hit: The panel pushed back immediately on the idea that cyber risk is primarily about technology. The attacks hitting brokerages today almost universally involve some form of identity manipulation. Stolen passwords, impersonated carriers, compromised email accounts, fake login pages that look exactly like the real thing. The bad guys are not breaking into IT systems. They are logging in.
Email is the front door. A single click on a phishing link that routes through a cloned Microsoft or Google login page is enough. Once attackers are inside a mailbox, they set up forwarding rules, watch conversations, and wait. According to Verizon’s annual data breach report, the average attacker historically sat inside a system for more than 200 days before striking. That number has come down, but the patience is real.
Three specific patterns came up repeatedly. The first is carrier email compromise, where an attacker infiltrates a legitimate carrier’s domain, sets up automatic forwarding to a Gmail account, and intercepts tenders before the real carrier ever sees them. If a carrier’s email does not match their FMCSA data, that is a red flag. The second is fake document requests, including what look like DocuSign confirmations, rate confirmations, or RFP attachments that route employees to fake login pages. The third is payment instruction fraud, where attackers insert themselves into a workflow at the exact moment a wire transfer or banking change is being processed.
Why size does not protect you: A common misconception is that small brokerages are not worth targeting. The panel addressed this directly. Automated AI tools have made it trivially cheap to run attacks at massive scale. A stolen credit card can spin up 100,000 bots. Attackers only need a one or two percent response rate. Small brokerages are not just targets in their own right. They are also potential jumping-off points to larger victims through compromised contact lists and credentials.
What to do in the first 24 hours: When an incident occurs, the worst thing a brokerage can do is scramble without a plan. The panel outlined five immediate priorities. First, contain the damage by disabling affected accounts and revoking malicious forwarding rules. Second, preserve evidence rather than wiping systems, since logs will be critical for tracing what happened. Third, protect the movement of money by calling your bank immediately and freezing any pending payment changes. Fourth, notify your insurance company before anyone else, including customers, since different states have different breach notification timelines and liability exposure varies. Fifth, stabilize operations by moving to out-of-band communication if email has been compromised.
The last place you want to build a strategy is in the middle of a crisis. Even a one-page incident response plan is dramatically better than none.
On cyber insurance: The cyber insurance market has matured quickly and the panel had nuanced things to say about it. The most important point is that insurance is a backstop, not a substitute for operational discipline. Claims get denied when policyholders had written policies in place and did not follow them. One real-world example from the panel: a quarter-million dollar wire fraud occurred despite an established verification policy because an employee received fake communications across three channels simultaneously and believed they had satisfied the verification requirement. The insurance did not cover it.
The best cyber insurers now want to be notified the moment an incident is suspected, not days later. Some maintain incident response teams that work directly with the Secret Service to claw back funds when reported quickly enough. Insurers are also increasingly scanning applicants’ public risk profiles before underwriting and rewarding organizations that run managed detection and response services with meaningful premium reductions.
The emerging threat landscape: AI has not created new categories of attack so much as it has made existing ones dramatically faster, cheaper, and more convincing. AI-assisted phishing now produces highly personalized lures at a scale that was not previously possible. Voice cloning requires only a seven-second audio sample. Deep fake technology is producing documents and video that are increasingly difficult to distinguish from real ones. Multi-channel impersonation, where a target receives a coordinated fake email, text, and voicemail simultaneously, is now a documented tactic.
SMS-based two-factor authentication is no longer considered secure. SIM card cloning is available on the dark web for minimal cost. Authenticator apps are a meaningfully more secure alternative.
Concrete steps any brokerage can take now: The panel kept returning to practical, accessible actions rather than overwhelming technical checklists. Enable multi-factor authentication everywhere, including on personal phones that access corporate email, which are frequently the least protected device in an organization. Formalize carrier onboarding and banking change verification so that payment instruction changes always require a verified callback through a known channel. Train your team not through formal curriculum necessarily, but through regular conversation about what fraud attempts actually look like. Make sure your systems are being backed up and that backups go back far enough that a compromised version can be rolled back.
And when something feels off, slow down and verify. The urgency that accompanies most fraud attempts is itself the red flag.
The TIA Cyber Seal of Approval: TIA is currently piloting a cyber certification program built around 18 critical controls from the Center for Internet Security, with two additional controls covering AI and social media risk. The program is expected to open applications to members in the summer, with additional details at the Capital Ideas conference in Phoenix.
The bottom line: Cyber risk in brokerage is not an event with a finish line. It is an ongoing business discipline. The brokerages that treat it that way, building processes, training teams, and reducing their attack surface one step at a time, are the ones best positioned to protect their customers, their carriers, and themselves.
