A new cybercrime group is raising concerns across the transportation and logistics industry after targeting several companies with ransomware attacks. Operating under the name Whitearmor, the group has reportedly focused on vulnerable web servers since emerging in October, with J.B. Hunt, Ryder System and Echo Global Logistics among its known targets.

The incidents have resulted in multiple lawsuits filed by employees in US federal courts. The plaintiffs accuse the companies of failing to implement adequate cybersecurity measures to protect sensitive personal information allegedly compromised during the attacks.

Ben Wilkens, director of cybersecurity at the National Motor Freight Traffic Association (NMFTA), said Whitearmor appeared in October and has been conducting highly targeted attacks against vulnerable web servers.

According to Wilkens, the group's victims include several transportation businesses, ranging from major national fleets and logistics providers to smaller regional operators.

The attacks against J.B. Hunt (NASDAQ: JBHT), Ryder System (NYSE: R) and Echo Global Logistics have been documented by ransomware.live, a platform that tracks ransomware incidents.

October attacks expose extensive data claims

The ransomware.live entry for J.B. Hunt dates the attack to October 23. Whitearmor claims to have obtained 140,838 employee records containing personally identifiable information (PII) and national identification numbers.

The group also alleges that it accessed 1.7 million carrier contacts, 38.2 million invoices, 187,000 role-based access control (RBAC) permission records, 3,196 ranked account-takeover targets, 973 Microsoft 365 mailboxes and 374,000 organizations.

Whitearmor reportedly demanded $5 million in exchange for the data, payable in bitcoin or monero. The group said payment instructions would be sent by email.

The incident has prompted at least six lawsuits against Arkansas-based J.B. Hunt in the US District Court for the Western District of Arkansas. Two of those cases have already been dismissed at the plaintiffs' request.

Echo Global is facing at least one lawsuit in the Northern District of Illinois, which includes Chicago, where the company is headquartered. Ryder, meanwhile, faces at least five lawsuits in the Southern District of Florida, which includes Miami, its headquarters city.

The plaintiffs are represented by different law firms. Although several complaints raise similar concerns about J.B. Hunt's cybersecurity practices, the allegations are not identical across the cases.

Workers seek class action status

Lawsuits came pretty fast after the attacks, illustrating the legal consequences that can flow from public disclosure of a cyber security breach.

Some of the attorneys listed in the filings are pro hac vice attorneys, meaning they are authorised to participate in a particular case in a jurisdiction in which they are not regularly admitted to practise. Some may be waiting for local admitted counsel to get involved.

The complaints seek class-action certification, meaning they have been filed on behalf of the named employees and all others who may have suffered similar harm.

The J.B. Hunt plaintiffs mirrored Whitearmor’s claim that it has 140,838 employee records with personally identifiable information and sought $5 million.

J.B. Hunt employee Shileen Lange has filed a complaint against the company, alleging it failed to protect employees’ private information, including by not encrypting or redacting highly sensitive records.

Lange's suit was later dismissed, but the arguments it made are similar to those in other cases brought against the three companies.

The complaint claims that the information was compromised because of negligent or careless acts and omissions and an alleged failure to protect employees’ sensitive data. It also says much of the information later appeared on the dark web.

Plaintiffs cite 14 cybersecurity steps allegedly ignored

The suit against J.B. Hunt lists 14 steps the company could have taken to prevent the alleged incidents but didn’t.

Measures mentioned include an employee awareness and training programme to prevent cybersecurity breaches, the use of antivirus and antimalware software to carry out regular automated scans, and firewall configurations that can block access from known malicious IP addresses.

The complaint claims that J.B. Hunt had the resources to prevent the breach, but did not invest enough in security measures, despite being required to protect the information it had in its possession.

No sign of ransomware. live reports that hackers have stolen customer data from J.B. Hunt.

But another charge is in a separate lawsuit filed by former employee Chris Ferguson. Whitearmor said in the complaint that J.B. Hunt had emailed customers quietly asking them to change their passwords rather than publicly disclosing the breach.

This is the plaintiff’s allegation, not independently established.

No reported disruption to transportation operations

Despite the scale of the data allegedly obtained, there have been no market reports indicating that the attacks disrupted the operations of J.B. Hunt, Ryder or Echo Global Logistics.

The situation differs from previous high-profile cyber incidents affecting transportation companies, including Estes Express and Forward Air (NASDAQ: FWRD), where significant operational consequences were reported following the breaches.

However, the allegations surrounding Echo Global point to a potentially broader exposure involving customer and carrier information.

In a lawsuit filed on November 4, former Echo employee James Weinmann alleges that Whitearmor claimed to have stolen 3,890 employee information packages during its October 28 attack.

The group also reportedly claimed access to records concerning 2,418 customers and 9,122 carriers, as well as information covering hundreds of thousands of freight loads, quotes, tenders and shipments.

These allegations of customer data theft do not appear in the lawsuits against J.B. Hunt or Ryder.

Weinmann left Echo Global in 2020, but his complaint refers to personal information about him that remained in the company's possession.

Like the litigation involving J.B. Hunt, the Echo lawsuit argues that the company could have taken preventative measures to avoid the breach but failed to do so.

J.B. Hunt Confirms Data Breach, Investigation Underway

J.B. Hunt did not immediately respond to comment before the original report. The company had, however, issued a statement to its local paper, the Arkansas Democrat-Gazette .

A company spokesperson confirmed J.B. Hunt was investigating a cybersecurity incident of unauthorised access to certain information within an isolated part of its technology system.

The company said its systems were still running and its ability to serve customers had not been disrupted.

J.B. Hunt hired a leading cybersecurity firm and implemented its incident response protocols shortly after becoming aware of the incident, the spokesperson said. The company also notified law enforcement and promptly terminated the unauthorised access.

J.B. Hunt said it was taking the issue seriously and continuing to investigate.

Filed on Nov. 4, the lawsuit against Echo Global alleges the company failed to publicly disclose the breach or inform those affected about the information allegedly taken and the steps they could take to protect themselves.

Ryder declined to comment on the cyberattack or the lawsuits. At the time of the original report, Echo Global had not responded to requests for comment.

Ransom demands reach $20 million at Ryder

Whitearmor's financial demands vary significantly across the three targeted companies.

According to the lawsuit involving Echo Global, the cybercriminals demanded $10 million in bitcoin following the October attack.

The ransomware.live entry concerning Ryder lists a ransom demand of $20 million, also payable in bitcoin.

As with J.B. Hunt, the lawsuits against Ryder do not allege that customer data was obtained during the October 28 attack.

NMFTA calls for stronger endpoint monitoring

In response to the growing threat, Ben Wilkens of the NMFTA has outlined several security measures that transportation companies should adopt to reduce their exposure to similar attacks.

His first recommendation is to ensure that Endpoint Detection and Response (EDR) solutions are deployed, active and monitored on web servers accessible from the internet.

He also advises companies to investigate unexpected processes launched by web services, suspicious command execution, webshell creation and unusual outbound connections.

Microsoft defines EDR as a cybersecurity solution that monitors endpoint activity, detects suspicious behaviour and helps security teams investigate and respond to threats in real time.

The recommendations underline the importance of continuous monitoring and proactive security measures as cybercriminals increasingly target the digital infrastructure supporting transportation and logistics operations.