Cyber Breaches in Commercial Fleets

• According to Mimecast, an IT security company, there were over 3.4 million cyber incidents on the transportation industry during 2019.
• Another report by Upstream Security identified that there were 60 major cyber attacks on automotive companies.
• A study from Resilience360 found that there were nearly 300 cyber attacks on the supply chain operations of companies in 2019.
• The yearly average loss from a single cyber attack in the transportation industry is valued at around $1 million.
• However, it is estimated that by the end of 2020, cyber attacks will account for over $7.2 billion lost revenue for the global transportation and logistics industry.
• The most common cyber attacks are ransomware, which usually hijack a part of a company's operations and hold it for ransom.
• The most common types of ransomware used are crypto-malware, lockers, scareware, and doxware.
• While ransomware attacks are costly, the clean-up that a company must do after the situation is resolved could cost 100 to 200 times more than the demanded ransom itself.
• The majority of black hat cyber attacks (91%) are done via wireless connection.
• Recently, there have been reports of new types of malware, called xHunt Trojan malware, that have been affecting been deployed against transportation companies.
• The malware is able to "scan for open ports on remote systems, upload and download files, take screenshots, find other systems on the network, run commands and create its own Remote Desktop Protocol (RDP) function," ultimately giving the hacker the ability to monitor every action on the infected system and even transfer files back and forth without notice.
• In terms of the types of cyber breaches in the transportation sector, there are malicious data breaches, privacy-related incidents, and unintentional disclosure of data.
• Malicious data breaches account for the majority of cyber attacks, costing on average about $330,000. 
• Privacy-related incidents cost between $1.5 million and $1.6 million, while the unintentional disclosure of data is the costliest, with an average cost of $3.2 million per incident.

TFI's ransomware attack

• On August 19, 2020, TFI International, one of the biggest North American transportation and logistics firm, announced that all of its Canadian courier divisions (Canpar Express, ICS Courier, Loomis Express, and TForce Integrated Solutions) fell victims to a ransomware attack. 
• The attack targeted the companies' critical systems, taking down their servers and procuring several files pertaining to the internal operations of Canpar.
• The servers were eventually restored after 5 days, with no impact or misuse of the company's client information.
• The Canadian courier was able to continue to meet most customer shipping needs, with small delays.
• According to several reports, TFI did not pay any ransom and the monetary impact on their operations was not disclosed.

A. Duie Pyle

• On June 15, 2019, A. Duie Pyle, one of the biggest less-than-truckload carrier based in West Chester, Pennsylvania, started experiencing server problems and wide-spread system shutdown.
• The incident was caused by a ransomware software that gained access to the system through phishing email attachments. 
• The hackers first targeted the company's communications, including their email servers and phone servers. 
• A Duie Pyle's servers were down for over 4 days, forcing them to use its customer service number to take orders.
• The attack was not able to breach the company's core operating systems, brokerage services, or their backups, which limited the attack only to the disruption of the company's communications and online services.
• They were able to restore the driver handheld mobile data communication systems and reactivate the voicemail system by June 18, but the network communications systems took a few more days to fully restore.
• According to Peter Latta, CEO of A. Duie Pyle, a ransom demand was presented, but the executive staff decided not to comply. 
• The total cost to A. Duie Pyle's operation as a result of the ransomware attack was not disclosed.

NotPetya's impact on FedEx

• On June 27, FedEx and several other companies that did business in Ukraine were hit with the NotPetya malware, engineered by Russian hackers that aimed to disrupt the operations of companies in Ukraine and around the world.
• The powerful malware was able to gain access to the systems of dozens of multinational companies and scramble their data centers, making it very difficult to retrieve most of it back.
• The total amount of losses caused by NotPetya amounted to over $10 billion. 
• FedEx, a multinational courier company, was one of the many companies that experienced heavy losses due to the malware.
• According to sources, the amount of damages done to their European division, TNT, amounted to over $400 million and resulted in the company losing over a third of their stock price value.
• FedEx reported that it was "exposed to the attack via an infected tax software update used by its Ukrainian office," which was able to disrupt a major part of its European business operations.
• The recovery process took the company over three months, with officials noting that, while their normal operations were able to resume, some of the data that was lost due to the attack might never be recovered.
• As the company's data was heavily encrypted, preventing employees from accessing the system, TNT was forced to operate on manual mode for over a month, causing big delays in shipping. 
• Luckily, no data breach or data loss to third parties was recorded.
• They also reported that they warehouse capacity was stretched to the limit, with "tens of thousands of unprocessed packages" at the end of each day instead of the usual "handful".
• The Federation of Small Businesses (FSB) has also noted that the shipping delays have caused a big strain on small businesses, with many business owners stating that they have a lot business as a result.
• Many of the effected customers and small businesses have also opted to start doing business with some of TNT's competitors in Europe.
• While this particular cyber incident is a bit older, it shows very well the amount of damage a single attack can do on the business operations of transportation and logistics companies that operate large fleets as well as the vulnerability of such companies in the face of a major cyber attack.

Number of Trucks by Size

• As of 2017, the total number of trucks, from class 1 to class 8 was 151,605,435, of which 11,125,081 trucks served in commercial fleets.
• Assuming that the growth rate (3.3%) remains similar to the period between 2014 and 2017, we can estimate that by 2019, there will be about 161,776,492 trucks in circulation.
• The majority of the trucks, over 94%, that serve in fleets are part of very small (between 1 and 4 trucks) or small-sized fleets (between 5 and 19 trucks).
• According to data from the FMCA, there are only 172 companies in the US that operate fleets of over 2,000 trucks and commercial vehicles.
• According to the National Transportation Statistics, the majority of trucks operated in the United States were light trucks (class 1 and 2) and super heavy-duty trucks (class 8). The breakdown is as follows:
• Class 1 trucks (less than 6,001 lb): 73.52% (62,617,300 / 85,174,800)
• Class 2 trucks (between 6,001 lb and 10,000 lb): 20.13% (17,142,300 / 85,174,800)
• Class 3 trucks (between 10,001 lb and 14,000 lb): 1.34% (1,142,100 / 85,174,800)
• Class 4 trucks (between 14,001 lb and 16,000 lb): 0.46% (395,900 / 85,174,800)
• Class 5 trucks (between 16,001 lb and 19,500 lb): 0.44% (376,100 / 85,174,800)
• Class 6 trucks (between 19,501 lb and 26,000 lb): 1.07% (910,300 / 85,174,800)
• Class 7 trucks (between 26,001 lb and 33,000 lb): 0.51% (436,800 / 85,174,800)
• Class 8 trucks (over 33,001 lb): 2.53% (2,154,100 / 85,174,800)
• Assuming that the distribution of the number of trucks in the different classes will remain the same today as it was in 2002, the breakdown is as follows:
• Class 1 trucks (less than 6,001 lb): 118,938,077 (0.7352 * 161,776,492)
• Class 2 trucks (between 6,001 lb and 10,000 lb): 32,565,608 (0.2013 * 161,776,492)
• Class 3 trucks (between 10,001 lb and 14,000 lb): 2,167,905 (0.0134 * 161,776,492)
• Class 4 trucks (between 14,001 lb and 16,000 lb): 744,172 (0.0046 * 161,776,492)
• Class 5 trucks (between 16,001 lb and 19,500 lb): 711,817 (0.0044 * 161,776,492)
• Class 6 trucks (between 19,501 lb and 26,000 lb): 1,731,008 (0.0107 * 161,776,492)
• Class 7 trucks (between 26,001 lb and 33,000 lb): 825,060 (0.0051 * 161,776,492)
• Class 8 trucks (over 33,001 lb): 4,092,945 (0.0253 * 161,776,492)

Truck sales by size and use by industries

• According to data from Statista, class 3 and class 8 trucks were the most sold in 2019.
• Over 327,000 class 3 and 276,000 class 8 trucks were sold that year.
• Classes 5, 6, and 7 all saw sales just bellow 100,000 trucks.
• Class 4 was by far the least sold truck type, with only 22,000 units sold.
• According to the National Private Truck Council (NPTC), truck fleets are deployed in many different industries, including, utilies services, food production, oil and gas, home services, sanitation, construction, retail/wholesale, and manufacturing.