Actions by a relatively new group of cybercriminals that have targeted many transportation companies in turn have led to lawsuits filed by employees of three big names that have gotten caught up in the crook’s web.
The cyber criminals operate under the name Whitearmor. Ben Wilkens, the director of cybersecurity at the National Motor Freight Traffic Association, said in an email to FreightWaves that Whitearmor “came on the scene very recently, October of this year, and engage in very targeted attacks of vulnerable webservers.”
He also said of Whitearmor that he has seen “several transportation companies, ranging from very large national fleets and logistics companies down to several smaller regional fleets targeted by this group since October.”
Three known logistics companies have been a target of a ransomware act carried out by Whitearmor since late October: J.B. Hunt (NASDAQ: JBHT), Ryder System (NYSE: R) and Echo Global Logistics.
All three companies are now the defendants in lawsuits from employees in the federal court system who are charging their respective companies with failing to protect personal information that the workers say was breached in the cybers attacks.
The ransomware.live website, which tracks ransomware attacks, has recorded the Whitearmor attacks on the three companies.
Happened in late October
The ransomware.live entry on J.B. Hunt says the attack occurred October 23. It also said the terms of the Whitearmor demand are as follows: “We hold 140,838 employee records with PII and national IDs, 1.7M carrier contacts, 38.2M invoices, 187K RBAC permission records, 3,196 ranked account-takeover targets, 973 M365 mailboxes, 374K organizations. Our demand: $5,000,000, in (bitcoin) or (monero, also a cryptocurrency). Instructions to follow by email.”
There are at least six lawsuits filed in the Western District of Arkansas against Arkansas-based J.B Hunt as a result of the Whitearmor breach. However, two of those suits already have been dismissed on the request of the plaintiffs.
There is at least one suit filed against Echo Global in the Northern District of Illinois, the judicial district that includes Chicago, Echo’s home base. And in the Southern District of Florida, which includes Ryder’s headquarters city of Miami, there are at least five suits filed against the company because of Whitearmor.
There is no one individual law firm that is listed as the attorney for the plaintiffs across the lawsuits. And while the allegations and criticism of J.B. Hunt’s cybersecurity practices are similar in the suits, they are not identical.
Suits came quickly
But the speed at which the suits were filed after the attacks suggest an active ecosystem of attorneys ready to pounce when a cybersecurity breach is publicized. (Several of the attorneys listed in the suits also come with the designation pro hac vice, which suggests they are placeholders until a local attorney admitted in that particular region can be found.)
The cases ask for the suits to be recognized as class actions, as they are filed for the individual plaintiffs “and on behalf of all others similarly situated.”
The suits repeat the Whitearmor claim that it is holding 140,838 Personally Identifiable Information (PII) employee records of J.B. Hunt employees and seeks a $5 million ransom.
“(J.B. Hunt) failed to adequately protect the Private Information of Plaintiff and Class Members––and failed to even encrypt or redact this highly sensitive information,” according to the lawsuit filed by J.B. Hunt employee Shileen Lange. Although her lawsuit is one of the ones that has been dismissed, her arguments are similar in the other actions filed against all three companies.
“This unencrypted, unredacted Private Information was compromised due to Defendant’s negligent and/or careless acts and omissions and its utter failure to protect Plaintiff’s and Class Members’ sensitive data,” the Lange lawsuit said. It adds that much of that data ended up on the “dark web as a result of the data breach.”
What plaintiffs say Hunt should have done
The suit says J.B. Hunt failed to implement a long list of preventative measures, 14 in all, including an “an awareness and training program” regarding the prevention of cybersecurity breaches, using anti-virus and anti-malware programs “to conduct regular scans automatically,” and “configure firewalls to block access to known malicious IP addresses.”
“(J.B. Hunt) had the resources necessary to prevent the Data Breach but neglected to adequately invest in security measures, despite its obligation to protect such information,” the lawsuit said.
There is nothing in the postings by ransomware.live that suggest the hackers obtained J.B. Hunt customer data. However, the suit filed by former employee Chris Ferguson says that “WhiteArmor has also asserted that, rather than disclosing the Data Breach, J.B. Hunt quietly emailed customers asking them to change their passwords.”
No reports of affected operations
There also are no reports from the market that any of the companies’ operations have been affected. That is unlike some other past notable cyber hacks in the transportation field, such as Estes Express or Forward Air (NASDAQ: FWRD), where word spread quickly that those companies had taken a big operational hit due to a cybersecurity breach.
But in the lawsuit involving Echo Global, filed by former employee James Weinmann, the plaintiff says Whitearmor claims that in its Echo hack on October 28, it took not just 3,890 packages of information on employees, but also “records relating to 2,418 customers and 9,122 carriers, and data concerning hundreds of thousands of freight loads, quotes, tenders, and shipments.” Allegations of theft of customer data can not be found in the actions against J.B. Hunt or Ryder.
Weinmann, the plaintiff in the Echo case, has not been an Echo employee since 2020. But there are references in the lawsuit to his data held by Echo Global.
The Echo suit is similar to the litigation filed against J.B. Hunt in that it alleges the 3PL could have taken steps that would have prevented such a breach and failed to do so.
J.B. Hunt had not provided FreightWaves with a comment by publication time. But it recently did provide its local newspaper, the Arkansas Democrat Gazette, with a statement.
“We are investigating a cybersecurity incident involving unauthorized access to certain information within an isolated portion of J.B. Hunt’s technology system,” the Democrat Gazette said a J.B. Hunt spokesman said in response to questions. “Our systems remain operational, and there has been no disruption to our ability to serve customers. Upon learning of the incident, we quickly implemented our response protocols with the support of a leading cybersecurity firm, notified law enforcement, and promptly revoked the unauthorized access. We take this matter seriously, and we are continuing to investigate.”
The lawsuit against Echo filed November 4 said the company had not “publicly acknowledged” the breach and “not notified affected individuals or told them what information was taken or how to protect themselves.”
Ryder declined comment on the cyberattack and lawsuits. Emails sent to Echo Global representatives by FreightWaves had not been responded to by publication time.
Crypto, please, not cash
The suit says the cyber thieves’ demand for ransom at Echo Global was $10 million, payable in bitcoin.
The suits against Ryder, like those against J.B. Hunt, do not allege that customer data was obtained in the October 28 hack. The ransomware.live page on the Ryder attack says the ransom demand is $20 million in bitcoin.
In his email to FreightWaves, Wilkens of the NMFTA recommended several steps companies should take to protect themselves against similar cyberattacks.
His first recommendation: “Ensure Endpoint Detection and Response (EDR) is deployed, active, and monitored on internet-facing web servers. Investigate unexpected processes launched by web services, suspicious command execution, webshell creation, and unusual outbound connections.”
Microsoft defines EDR as “a cybersecurity solution that monitors endpoint activity, detects suspicious behavior, and helps security teams investigate and respond to threats in real time.”
More articles by John Kingston
For transportation cybersecurity, AI isn’t helping fight..so far
Beautiful women, open doors and drivers: trucking cybersecurity risks proliferate
Cyberattack response plans need to be in place to avoid chaos
