Cybersecurity Basics for Small Freight Forwarders

For a small freight forwarder, cybersecurity comes down to a short list of habits that stop the common attacks: multi-factor authentication on every account that can reach email, money or customer data; backups that an attacker on your network cannot delete; software updates applied within days, not months; and accounts that are removed the day a person leaves. A forwarder runs on shared inboxes, carrier portals, booking platforms and bank logins, so one stolen password can touch all of them. This guide is about the operating baseline. Payment redirection fraud has its own post, Business Email Compromise and Bank Detail Fraud in Freight, and is not repeated here.

What cyber threats do small forwarders actually face?

There is no reliable public statistic for how often forwarders specifically are attacked, so this post uses none. What can be said is how the attacks work, because the freight workflow gives each one a convenient disguise.

• Ransomware. Attackers encrypt your files and systems and demand payment, often after copying data first. Large logistics companies are not immune: Expeditors International disclosed in SEC filings that it was the target of a cyber-attack on 20 February 2022 and shut down most of its global operating systems. Its first-quarter 2022 results reported about $40 million in incremental demurrage charges, plus about $20 million of investigation, recovery, remediation and estimated shipment-claim costs. The filings do not name the type of attack. The lesson for a small firm is the mechanism: when systems stop, freight keeps moving and demurrage keeps accruing.
• Credential theft through fake booking or tracking links. An email with a "booking confirmation", "arrival notice", "tracking update" or "document to sign" link sends staff to a copy of a login page. Forwarders open attachments and links from strangers all day, because new shippers and carriers are the business. That is the opening this attack uses.
• Compromised carrier-portal, platform and e-AWB accounts. The same stolen password may unlock a carrier booking portal, an air cargo system account or a customs filing login. An attacker who gets in can read your bookings and customer details and may be able to change instructions.

Which public framework should a small forwarder follow?

Pick one named framework instead of inventing a checklist, because customers, insurers and auditors recognise them. Three are free to use and suit a small firm.

• UK NCSC Cyber Essentials. A scheme developed by the National Cyber Security Centre and run through IASME. It is built on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The NCSC's published requirements document (version 3.3, April 2026) is written in plain language and is a good checklist even outside the UK. You can certify or simply use it as a guide.
• CISA Cross-Sector Cybersecurity Performance Goals (CPGs). A voluntary US set of prioritised practices that CISA says helps small and medium-sized organisations focus on a limited number of high-impact actions. The current version, CPG 2.0, aligns to NIST CSF 2.0 and adds goals on cybersecurity oversight, managed service provider risk, least privilege and incident communication procedures.
• NIST Cybersecurity Framework 2.0. Released on 26 February 2024, it organises security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST publishes quick-start guides for specific user groups, with small businesses as an example.

The minimum baseline, mapped to the five controls

The 14-day figure comes from the Cyber Essentials requirements, which say software must be removed when it becomes unsupported and updated, including vulnerability fixes, within 14 days of release. The document is also explicit that cloud services cannot be left out of scope, which matters for a forwarder whose critical systems are mostly in a browser.

Multi-factor authentication: which accounts first

Start with email, because a mailbox is the reset path for almost every other account. Then do your bank portal, your TMS or booking platform, carrier and airline portals, customs filing logins, the cloud storage that holds shipping documents, and every admin account. The Cyber Essentials requirements say authentication to cloud services must always use MFA, and that administrative and internet-accessible accounts should always have it.

Not every second factor is equal. The same document notes that SMS codes are not the most secure type of MFA but still offer a large advantage over none, and recommends alternatives where they fit. CISA's #StopRansomware Guide goes further and asks for phishing-resistant MFA on all services, prioritising email, VPNs and accounts that reach critical systems. In practice: an authenticator app is a fair step up from text messages, and a hardware security key or passkey is better still for the owner, the finance lead and anyone with admin rights. If a carrier or platform offers no MFA at all, write that down as a known risk and use a long, unique password stored in a password manager.

Backups that ransomware cannot reach

Many people think having a cloud copy of the files means they are backed up. A synced folder is not a backup: if ransomware encrypts the originals, the encrypted versions sync across. CISA's #StopRansomware Guide recommends keeping offline, encrypted backups of critical data and testing them regularly, and explains why: many ransomware variants try to find and then delete or encrypt any backups they can reach.

The test for your setup is simple. Ask whether an attacker holding your normal admin login could delete every copy. If yes, you have a convenience copy, not a recovery plan. A workable arrangement for a small forwarder:

• Keep at least one copy that is offline, or in storage that a separate account controls and that cannot be altered or deleted for a set period (some cloud providers offer immutable storage).
• Back up what you cannot rebuild: the TMS or accounting data, the shipment file archive (bills of lading, commercial invoices, customs entries), customer and carrier contact records, and rate sheets.
• Restore a sample file and a full folder once a quarter, and note how long it took.

Shared mailboxes, portal accounts and offboarding

Freight offices share logins by habit: a "bookings@" mailbox, a single login to a carrier portal, one customs-agent credential that everyone knows. Shared credentials mean you cannot tell who did what, and they cannot be revoked for one person without disrupting everybody. Cyber Essentials expects unique credentials for each user and the removal or disabling of accounts that are no longer required, for example when a person leaves or after a period of inactivity.

Where a portal truly offers only one login, treat it as a controlled asset: keep the password in a shared password manager, restrict who can open it, put MFA on the mailbox that receives its codes, and change the password whenever someone with access leaves. For shared mailboxes, prefer a proper shared mailbox with named delegates over a shared password.

The offboarding checklist, to run on the person's last day (or immediately for a sudden exit):

• Disable the email account and active sessions; convert to a shared mailbox or forward if customers still write to it.
• Remove them from carrier, airline, platform, customs and bank portals, and change any shared password they knew.
• Revoke their access to cloud storage, the TMS, accounting and messaging tools.
• Collect laptops and phones, and remove business apps from personal phones.
• Remove special privileges when someone changes role, not only when they leave. Cyber Essentials lists this as a requirement.
• Keep a short log of what was revoked and when.

Use separate admin accounts too. The Cyber Essentials requirements say administrative activity should use a separate account, with no email or web browsing from it, so that a bad click on a normal day does not hand over the keys.

What customers' security questionnaires usually ask

Larger shippers, and increasingly mid-sized ones, send supplier questionnaires before they award a lane. The wording varies and there is no single freight standard, but the questions typically cover the same ground as this baseline:

• Is MFA enforced on email and on systems that hold customer data?
• Are backups kept offline or immutable, and when were they last tested?
• How quickly are security updates applied, and is unsupported software in use?
• Do staff have named accounts with least-privilege access, and how are leavers removed?
• Is there a written incident response plan, and who is the contact if something happens?
• Is there staff training, a certification such as Cyber Essentials or ISO 27001, and cyber insurance?

Answer honestly. A questionnaire that you can fill in with dated evidence (a screenshot of the MFA policy, the last restore test, the offboarding log) wins more trust than confident claims you cannot show. Where an answer is "not yet", say what date you will fix it.

Incident response basics: what to do and who to tell

Write the plan on one page before you need it. The point is to avoid making decisions in a panic. A workable sequence:

1. Contain. Disconnect affected devices from the network and Wi-Fi, but do not wipe them. Disable compromised accounts and reset passwords from a clean device.
2. Record. Note times, screens, ransom notes and the first suspicious email. Keep evidence.
3. Call for help. Contact your IT provider and your insurer, whose policy may specify a hotline or require notice before spending money on recovery.
4. Report. In the United States, CISA asks organisations to report ransomware incidents at cisa.gov/report and to consider requesting assistance from CISA and their local FBI field office; the FBI's Internet Crime Complaint Center (ic3.gov) takes complaints about cybercrime. Elsewhere, use your national cyber agency and police reporting channel.
5. Check data protection duties. Under the UK GDPR, the Information Commissioner's Office says a breach likely to pose a risk to people's rights and freedoms must be reported no later than 72 hours after you become aware of it, and affected individuals must be told without undue delay when the risk is high. Other countries have their own rules and deadlines, so check yours with a lawyer or the regulator.
6. Tell affected customers and carriers so they can rotate passwords and watch for phishing in your name.

Whether to pay a ransom is a legal and business decision, not a technical one. CISA's guide does not tell victims whether to pay, but advises consulting federal law enforcement, even where mitigation looks possible, in case a decryptor exists. Backups you have tested are the thing that keeps that decision from being forced.

Cyber cover: what insurance does and does not replace

Cyber insurance can pay for forensic investigation, legal advice, notification costs and sometimes business interruption, and some policies bring a 24-hour incident hotline. It does not fix your systems and it is not a licence to skip the baseline: insurers often ask about MFA, backups and patching on the proposal form, and a wrong answer can cause trouble at claim time. How cyber cover sits beside E&O and cargo legal liability is covered in Freight Forwarder Insurance: E&O, Cargo Legal Liability and Cyber Cover Explained. In the UK, the NCSC page for Cyber Essentials says organisations with turnover under £20 million that certify their whole organisation qualify for cyber liability insurance arranged by IASME (as of the page read in October 2026, so check current terms).

What to do next

1. Turn on MFA this week for email, the bank portal and every admin account, then work through carrier and platform logins.
2. Test one restore from an offline or immutable backup, and fix the gap if an admin login could delete every copy.
3. Replace shared logins with named accounts or a shared password manager, and run the offboarding checklist for anyone who left in the last year.
4. Write a one-page incident plan with phone numbers for your IT provider and insurer, then read Freight Fraud: Fictitious Pickups and Double Brokering alongside the business email compromise guide so staff recognise the social side of the attack.

More than 29,300 logistics companies are searchable by country and service in the CargoLinked directory, and the public requests board lists freight that shippers have posted for forwarders to quote on directly. See the requests board for current opportunities.

This article is general information, not legal, insurance or cybersecurity advice. Frameworks, thresholds and reporting rules change and differ by country. Confirm current requirements with the issuing authority, your regulator, your insurer or a qualified security professional. As of October 2026.