The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Transportation
Breach intelligence, attack campaigns, and threat reports targeting the Transportation sector.
Explore Other Sectors
Transportation Threat Reports
Student Exploits TETRA Vulnerabilities to Halt Taiwan High-Speed Trains
In April 2026, a 23-year-old university student in Taiwan exploited vulnerabilities in the Taiwan High Speed Rail Corporation's (THSRC) TETRA communication system. Utilizing software-defined radio (SDR) equipment and handheld radios, the student transmitted a forged 'General Alarm' signal, causing four high-speed trains to halt operations for 48 minutes. The attack was facilitated by the static nature of the system's parameters, which had remained unchanged for 19 years, allowing the student to bypass multiple verification layers. Authorities arrested the individual, who now faces charges under Article 184 of the Criminal Law, with potential imprisonment of up to 10 years. This incident underscores the critical need for regular security assessments and updates in communication systems, especially those integral to public safety and infrastructure. The exploitation of longstanding vulnerabilities in the TETRA protocol highlights the urgency for organizations to proactively address potential security gaps to prevent similar disruptions in the future.
4 months ago
Kill Chain
Surge in Cyber-Enabled Cargo Theft: A 2025 Analysis
In 2025, cargo theft losses in the United States and Canada surged by 60%, reaching an estimated $725 million. This increase is attributed to cybercriminals employing sophisticated tactics such as phishing, impersonation, and system compromises to hijack goods during transit. By infiltrating supply chain systems, these actors rerouted shipments, leading to significant financial and operational disruptions for businesses. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260430?utm_source=openai)) The FBI's April 30, 2026, public service announcement underscores the evolving nature of cargo theft, emphasizing the integration of cyber techniques into traditional theft methods. This trend highlights the urgent need for enhanced cybersecurity measures within the transportation and logistics sectors to mitigate the risks posed by these advanced threats. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260430?utm_source=openai))
4 months ago
Kill Chain
FBI Reports 60% Increase in Cyber-Enabled Cargo Thefts in 2025
In 2025, the FBI reported a 60% increase in cyber-enabled cargo thefts across the U.S. and Canada, totaling nearly $725 million in losses. Threat actors infiltrated freight brokers and carriers through phishing emails and fake web links, gaining unauthorized access to systems. They then posted fraudulent listings on online load boards, impersonated legitimate companies, and diverted high-value shipments for resale. The Diesel Vortex group, active since September 2025, targeted freight and logistics operators in the U.S. and Europe, compromising numerous platforms and stealing credentials. This surge underscores the evolving tactics of cybercriminals who exploit digital vulnerabilities to execute physical thefts. The transportation and logistics sectors must enhance cybersecurity measures to protect against such sophisticated attacks.
4 months ago
Kill Chain
SpiceJet Online Booking System Vulnerabilities Expose Passenger Data
In April 2026, two critical vulnerabilities were identified in SpiceJet's Online Booking System: CVE-2026-6375 and CVE-2026-6376. These flaws allowed unauthenticated users to access passenger name records (PNRs) and full booking details using only a PNR and last name, due to missing authorization checks and authentication mechanisms. This exposed sensitive personal and travel information to potential exploitation. ([securityvulnerability.io](https://securityvulnerability.io/vulnerability/CVE-2026-6376?utm_source=openai)) The incident underscores the importance of robust access controls in online systems, especially in the transportation sector. Organizations must prioritize securing sensitive customer data to prevent unauthorized access and potential misuse.
5 months ago
Kill Chain
BlackFile's Vishing Attacks: A Wake-Up Call for Retail and Hospitality Sectors
In early 2026, the BlackFile extortion group initiated a series of data theft and extortion attacks targeting retail and hospitality organizations. Employing voice phishing (vishing) tactics, they impersonated IT support staff to deceive employees into divulging credentials and one-time passcodes. With these credentials, BlackFile registered their own devices to bypass multi-factor authentication, escalated access to executive accounts, and exfiltrated sensitive data from platforms like Salesforce and SharePoint. The stolen data was then used to pressure victims into paying seven-figure ransoms, with threats of public disclosure on their dark web leak site. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-blackfile-extortion-gang-targets-retail-and-hospitality-orgs/?utm_source=openai)) This incident underscores a significant shift in cybercriminal tactics, highlighting the increasing prevalence of vishing attacks that exploit human vulnerabilities rather than technical system flaws. The success of such social engineering methods emphasizes the need for organizations to enhance employee training and implement robust verification protocols to mitigate similar threats. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-blackfile-extortion-gang-targets-retail-and-hospitality-orgs/?utm_source=openai))
5 months ago
Kill Chain
Critical Vulnerability in Siemens RUGGEDCOM CROSSBOW SAC: CVE-2025-6965
In April 2026, Siemens disclosed a critical vulnerability (CVE-2025-6965) in its RUGGEDCOM CROSSBOW Station Access Controller (SAC) versions prior to V5.8. This flaw, stemming from a numeric truncation error in the integrated SQLite component, could allow remote attackers to execute arbitrary code or cause a denial-of-service condition. The vulnerability affects systems deployed worldwide in critical manufacturing sectors. Siemens has released version V5.8 to address this issue and strongly recommends users update to this latest version. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-994087.html?utm_source=openai)) This incident underscores the persistent risks associated with third-party software components in industrial control systems. As attackers increasingly target vulnerabilities in widely used libraries, organizations must prioritize timely updates and rigorous security assessments to safeguard critical infrastructure.
5 months ago
Kill Chain
Zero Motorcycles Firmware Vulnerability Exposes Riders to Potential Attacks
In April 2026, a vulnerability identified as CVE-2026-1354 was discovered in Zero Motorcycles' firmware versions 44 and earlier. This flaw allows an attacker in close proximity to forcibly pair a device with the motorcycle via Bluetooth. Once paired, the attacker can exploit the over-the-air firmware update functionality to potentially upload malicious firmware, compromising the motorcycle's integrity. The attack requires the motorcycle to be in Bluetooth pairing mode, and the attacker must maintain proximity throughout the firmware update process. ([securityvulnerability.io](https://securityvulnerability.io/vulnerability/CVE-2026-1354?utm_source=openai)) This incident underscores the growing cybersecurity risks associated with connected vehicles, particularly in the transportation sector. As vehicles become increasingly integrated with wireless technologies, vulnerabilities like this highlight the urgent need for robust security measures to prevent unauthorized access and ensure user safety.
5 months ago
Kill Chain
Critical Vulnerabilities in Hardy Barth Salia EV Charge Controllers Expose Infrastructure Risks
In April 2026, CISA disclosed two critical vulnerabilities in Hardy Barth's Salia EV Charge Controller firmware versions up to 2.3.81. Identified as CVE-2025-5873 and CVE-2025-10371, these flaws allow remote attackers to upload malicious files via the web interface, potentially leading to remote code execution. Despite public proof-of-concept exploits being available, Hardy Barth has not responded to coordination requests, leaving systems at risk. This incident underscores the growing cybersecurity challenges in the EV infrastructure sector. The lack of vendor response highlights the need for proactive security measures and vigilant monitoring to protect critical energy and transportation systems from emerging threats.
5 months ago
Kill Chain
Critical Vulnerability in Siemens RUGGEDCOM SAM-P: Immediate Action Required
In April 2026, a critical privilege escalation vulnerability (CVE-2026-27668) was identified in Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) versions prior to V5.8. This flaw allows authenticated User Administrators to modify their own group memberships, potentially granting themselves elevated access across device groups. Siemens has addressed this issue by releasing version V5.8 and recommends immediate updates to mitigate the risk. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-741509.html?utm_source=openai)) This incident underscores the importance of stringent access controls and regular software updates in industrial control systems. Organizations should review their administrative privileges and ensure that all systems are updated to prevent unauthorized access and maintain operational integrity.
5 months ago
Kill Chain
BRIDGE:BREAK Vulnerabilities Threaten Critical Infrastructure Security
In April 2026, Forescout Technologies identified 22 vulnerabilities in serial-to-IP converters from Lantronix and Silex, devices integral to connecting legacy industrial equipment to modern networks. These vulnerabilities, collectively named BRIDGE:BREAK, could allow attackers to disrupt operations, move laterally across networks, tamper with sensitive data, or take control of affected devices. The flaws include remote code execution, authentication bypass, firmware manipulation, denial of service, and exposure of confidential information. Notably, tens of thousands of these devices are accessible over the internet, significantly broadening the attack surface for potential cyberattacks. This discovery underscores the persistent security challenges in operational technology environments, especially concerning devices that bridge legacy systems with modern infrastructure. The prevalence of these vulnerabilities highlights the need for organizations to reassess their security postures, particularly in sectors like utilities, manufacturing, and healthcare, where such devices are commonly deployed.
5 months ago
Kill Chain
Eurail 2025 Data Breach: A Wake-Up Call for Travel Industry Cybersecurity
In late December 2025, Eurail B.V., a Netherlands-based travel company, experienced a significant data breach when unauthorized actors accessed its network and exfiltrated files containing sensitive customer information. The breach, which occurred on December 26, 2025, was discovered on January 5, 2026, and confirmed on February 25, 2026. Approximately 308,777 individuals were affected, with compromised data including names, passport numbers, dates of birth, email addresses, postal addresses, phone numbers, bank account references (IBANs), and health-related information. ([claimdepot.com](https://www.claimdepot.com/data-breach/eurail-2026?utm_source=openai)) This incident underscores the escalating threat landscape targeting the travel industry, where personal data is highly valuable. The breach highlights the critical need for robust cybersecurity measures, including regular system audits, employee training, and comprehensive incident response plans to mitigate potential risks and protect customer information.
5 months ago
Kill Chain
Beware: QR Code Phishing Scams Targeting Drivers in 2026
In early 2026, a sophisticated phishing campaign emerged across multiple U.S. states, including New York, California, and Texas. Scammers sent fraudulent text messages impersonating state courts, alleging recipients had outstanding traffic violations. These messages included images of fake court notices embedded with QR codes, urging immediate payment of fines to avoid severe penalties. Scanning the QR codes redirected victims to phishing websites designed to steal personal and financial information. This method, known as 'quishing' (QR code phishing), represents an evolution in cybercriminal tactics, leveraging QR codes to bypass traditional security measures and exploit the trust users place in official-looking communications. The widespread nature of this scam underscores the need for heightened vigilance and public awareness regarding unsolicited messages containing QR codes.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports