The container has arrived. But someone changed the instructions.

Logistics office overlooking a container terminal, with a digital route and warning on a laptop. AI illustration. — AI-generated illustrative image. Not a photograph of the reported event.

Saverio Zavaglia · 22/10/2026 · 5 min read

Imagine an international freight forwarder arranging a shipment of industrial components from Genoa to an overseas customer.

The goods are properly loaded. The documentation is complete. The transport is insured.

Then an apparently genuine message arrives: new bank details for an invoice payment. The email appears to come from the usual correspondent.

The payment is made. But the money goes to an account controlled by cybercriminals.

Or something else happens: delivery instructions are altered, credentials for a logistics platform are compromised, or the forwarder’s management system is blocked.

The goods may be perfectly intact. The financial loss, however, could be enormous.

These are illustrative scenarios, not a reconstruction of a particular claim. They highlight an issue the logistics sector can no longer treat as marginal.

Cyber risk has become a supply-chain risk

The ENISA Threat Landscape 2026 report, published on 22 September, confirms that ransomware remains among the threats with the greatest immediate impact. Transport accounts for around 8% of the events analysed. Digital dependencies between businesses also expand the attack surface. [1]

This concerns more than major port terminals and shipping lines. It also affects the twenty-person forwarding business, customs broker, consolidator, haulier and operator coordinating shipments through shared platforms.

A business can have adequately protected IT systems and still suffer from a supplier’s compromise. In logistics, a company’s cybersecurity also depends on the security of those with whom it exchanges information.

Freight forwarder liability: where does cyber risk end and professional risk begin?

This is the point that deserves particular attention.

When a cyberattack causes misdelivery, delay or financial loss, restoring systems is only part of the issue.

It is necessary to establish who assumed the contractual obligations, what checks could reasonably have been expected and whether the cyber event caused the alleged loss.

The positions of a forwarder acting solely as an intermediary, a forwarder acting as carrier and a logistics operator undertaking additional obligations may differ significantly.

A false delivery instruction could trigger a claim for improper performance of the forwarding mandate. Ransomware could prevent the preparation of documents needed to release cargo. Compromised data could also trigger notification duties and liability under personal data protection rules.

This does not mean every attack automatically creates liability for damages. It means cyber risk can become a professional liability risk requiring examination of the contractual terms, conduct and insurance cover.

The big misconception: “I have cargo insurance, so I am covered”

Not necessarily.

Cargo insurance protects different interests and risks from freight forwarders’ liability insurance or Cyber cover.

Traditional policies may contain exclusions or restrictions concerning cyber events, pure financial losses, operational interruption and payment fraud.

Nor does a Cyber policy automatically protect against every financial consequence of an attack.

At least five elements need checking:

Third-party liability: are claims arising from operational errors caused by a cyber incident covered?
Business interruption: is downtime indemnifiable, and what waiting periods and indemnity periods apply?
Cyber fraud: does cover include fraudulent fund transfers, or are specific extensions required?
Technology providers: what happens when the outage affects a cloud management system or external operator?
Incident response costs: are IT support, legal advice, forensic analysis and notification management included?

The answer is not in the product name. It is in the policy wording.

The real loss may not be the first one you see

An attacked freight forwarder could simultaneously face recovery costs, specialist advisers’ fees, lost revenue and customer claims.

Demurrage, detention, additional storage costs and extraordinary expenses to restore business continuity may follow.

Not all these items are automatically insurable or recoverable. But all must be considered when assessing the financial exposure in advance.

For many businesses, the greatest risk is not simply losing data. It is losing the ability to meet their obligations while the goods continue moving.

From cybersecurity to risk governance

The International Maritime Organization has progressively strengthened its maritime cyber risk management guidelines, updated in 2026. [2]

In parallel, the EU’s NIS2 framework imposes risk management and security requirements on certain categories of entities, subject to applicable criteria and national rules. Not every freight forwarder is automatically subject to the same obligations. [3]

For a logistics operator, the right question is therefore not only whether its IT system is secure. It is whether the business can continue operating, manage customers and protect its assets when that system stops working.

Verification procedures for sensitive instructions, multifactor authentication, tested backups, continuity plans and clear internal responsibilities are necessary. So is a coordinated insurance review.

My conclusion: digital trust also needs protection

For decades, transport insurance strategies have centred on physical events: theft, fire, damage, cargo loss and transport liability.

Today, a growing share of a shipment’s economic value depends on something invisible: the integrity of information.

One compromised credential can be enough to undermine an entire commercial operation.

That is why I believe Cyber Risk must become a permanent part of every freight forwarder’s risk assessment, alongside cargo cover, professional liability and business continuity.

The question is no longer just: “Who pays if the goods arrive damaged?”

It is: “Who pays if the goods arrive intact, but a cyberattack has compromised the entire operation?”

Every freight forwarder should ask that question before receiving the first claim.

Saverio Zavaglia Specialist insurance consultancy for ports, freight forwarding, transport and supply-chain risks.

Sources and references

Sources checked: 22/10/2026

General professional insight. Individual situations require a review of documents and specific circumstances.

Let’s talk about your shipment.

Start with your operations, contracts and policy wording.

Talk to Saverio ↗

← All articles