Estes Forwarding Worldwide

Summary

A subsidiary of one of North America's largest private freight carriers experienced a cyber event in late May, prompting the company to notify employees and customers while launching an investigation. The Richmond, Virginia-based logistics and freight forwarding firm reported that robust cybersecurity protocols, system redundancies, and a swift response from internal IT staff and third-party security experts allowed operations to resume within hours, with no significant business disruption. Neither the parent company's less-than-truckload operations nor its logistics division were impacted, and the organization stated it plans to enhance its security measures following the incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On May 28, 2025, Estes Forwarding Worldwide (EFW), a Richmond, Virginia-based subsidiary of Estes Express Lines, experienced a cyber event affecting its operations. The company disclosed the attack publicly through communications to employees, customers, and partners, confirming the date of the incident as on or about May 28, 2025. EFW specializes in providing a full suite of logistics and freight forwarding services, and it operates as part of one of the largest less-than-truckload (LTL) carrier networks in North America through its parent company, Estes Express Lines, which is recognized as the largest private carrier on the continent. The cyberattack specifically targeted EFW, with the company indicating in its communications that the incident was confined to its own systems and did not spread to related Estes business units.

CEO Scott Fisher addressed the cyber event in an email sent to stakeholders, stating that the company experienced the cyber event on or about May 28. Fisher emphasized that there was no significant disruption to business operations, crediting the company's existing cybersecurity protocols, system redundancies, and the rapid response of its internal IT team along with third-party security experts. According to Fisher's statement, Estes Forwarding Worldwide was able to resume full operations within hours of the incident, demonstrating the effectiveness of its pre-established security measures and incident response capabilities. The CEO also acknowledged the support provided by parent company Estes Express Lines throughout the incident, noting that neither Estes LTL nor Estes Logistics were impacted by this event. This containment of the incident to EFW's specific operations suggests that the attack was isolated rather than spreading across the broader Estes corporate network.

In the immediate aftermath of the cyberattack, EFW took several response actions beginning with notification of employees and customers about the cyber event. The company initiated an investigation into the nature and scope of the cyberattack while simultaneously working to restore any affected systems. EFW also committed to enhancing its security measures based on findings from the investigation. The incident response involved coordination between EFW's internal IT personnel and external third-party security experts who assisted in managing the event and ensuring business continuity. This collaborative approach between internal teams and external specialists allowed the company to maintain operational continuity and limit the impact on its logistics and freight forwarding services.

The cyberattack on EFW occurred within a broader context of cybersecurity challenges affecting the logistics and distribution industry. The incident followed a previous cyberattack against Estes Express Lines in October 2023, which had caused an outage in the parent company's IT infrastructure. Other logistics and supply chain related companies have similarly reported cybersecurity issues during this period, including United Natural Foods Inc., a major distributor for Whole Foods, and Blue Yonder, a supply chain management software provider. These collective incidents across the logistics sector highlight an ongoing pattern of cyber threats targeting transportation, distribution, and supply chain operations, though no connection between these separate events has been established. The recurrence of cyberattacks against companies within the Estes corporate family, even if affecting different subsidiaries, underscores the persistent cybersecurity risks facing the freight and logistics industry.

EFW's communication strategy following the cyberattack focused on transparency with stakeholders while reassuring customers and partners about the limited impact on operations. The company framed its response by emphasizing the swift restoration of services and the effectiveness of its cybersecurity infrastructure. Fisher's email concluded by reaffirming the company's commitment to protecting customer information and maintaining trust, positioning these as the organization's highest priorities. The statement indicated that EFW would continue to investigate the incident and implement additional security enhancements to prevent future occurrences. The rapid operational recovery, achieved within hours according to company statements, reflects the importance of pre-established redundancies and coordinated incident response procedures in mitigating the effects of cyberattacks on logistics operations.

Sources

Sources available to members: 1 source.