Ransomware gang Whitearmor hit J.B. Hunt, Ryder and Echo in late October, employee lawsuits say, with claimed demands of $5 million, $20 million and $10 million

A relatively new group of cybercriminals has targeted transportation companies since October and has now drawn employee lawsuits against three of the biggest names in freight, according to FreightWaves on Nov. 12. The group operates under the name Whitearmor and, in the words of Ben Wilkens, the director of cybersecurity at the National Motor Freight Traffic Association, "came on the scene very recently, October of this year, and engage in very targeted attacks of vulnerable webservers." Wilkens told FreightWaves he has seen several transportation companies targeted since October, from very large national fleets down to smaller regional fleets.

The three known logistics companies hit since late October are J.B. Hunt, Ryder System and Echo Global Logistics, and all three are now federal-court defendants, sued by employees charging their companies failed to protect personal information breached in the attacks. The ransomware.live website, which tracks ransomware attacks, has recorded all three attacks. Its entry on J.B. Hunt says the attack occurred on Oct. 23 and quotes the group's demand in its own words: "We hold 140,838 employee records with PII and national IDs, 1.7M carrier contacts, 38.2M invoices, 187K RBAC permission records, 3,196 ranked account-takeover targets, 973 M365 mailboxes, 374K organizations. Our demand: $5,000,000, in (bitcoin) or (monero, also a cryptocurrency)." Those holdings are the attackers' claim, repeated in the lawsuits — not a confirmed inventory.

The litigation moved fast: at least six lawsuits have been filed against J.B. Hunt in the Western District of Arkansas, two of them already dismissed at the plaintiffs' request. There is at least one suit against Echo Global in the Northern District of Illinois and at least five suits against Ryder in the Southern District of Florida. Every case asks to be recognized as a class action, filed for the individual plaintiffs "and on behalf of all others similarly situated."

The J.B. Hunt suits repeat Whitearmor's claim that it is holding 140,838 records of personally identifiable information on J.B. Hunt employees and sought a $5 million ransom. A lawsuit filed by J.B. Hunt employee Shileen Lange — one of the two since dismissed, though its arguments resemble the others — says the company "failed to adequately protect the Private Information of Plaintiff and Class Members — and failed to even encrypt or redact this highly sensitive information," and lists 14 preventative measures it says J.B. Hunt failed to implement. A suit by former employee Chris Ferguson repeats Whitearmor's assertion that, rather than disclosing the breach, J.B. Hunt quietly emailed customers asking them to change their passwords. Nothing in the ransomware.live postings suggests the hackers obtained J.B. Hunt customer data.

Echo's case carries the broadest claims of the three. The suit filed by former employee James Weinmann says Whitearmor claims that in its Echo hack on Oct. 28 it took not just 3,890 packages of information on employees but also records relating to 2,418 customers and 9,122 carriers, and data concerning hundreds of thousands of freight loads, quotes, tenders and shipments. Allegations of stolen customer data do not appear in the actions against J.B. Hunt or Ryder. The Echo suit says the ransom demand there was $10 million, payable in bitcoin, and a lawsuit filed on Nov. 4 said Echo had not "publicly acknowledged" the breach and had "not notified affected individuals or told them what information was taken or how to protect themselves." The ransomware.live page on the Ryder attack, also dated Oct. 28, puts that demand at $20 million in bitcoin; the suits against Ryder, like those against J.B. Hunt, do not allege that customer data was obtained.

What has not happened, so far, is an operational shutdown: there are no reports from the market that any of the three companies' operations have been affected, unlike past transportation hacks at Estes Express and Forward Air, where the operational hit was widely reported. J.B. Hunt told its local newspaper, the Arkansas Democrat Gazette: "We are investigating a cybersecurity incident involving unauthorized access to certain information within an isolated portion of J.B. Hunt's technology system. Our systems remain operational, and there has been no disruption to our ability to serve customers. Upon learning of the incident, we quickly implemented our response protocols with the support of a leading cybersecurity firm, notified law enforcement, and promptly revoked the unauthorized access." Ryder declined comment on the attack and the lawsuits, and emails to Echo Global representatives had not been answered by publication time.

For drivers and small carriers, the exposure here is personal as much as operational. The records Whitearmor claims to hold at J.B. Hunt are employee records — personal information and national IDs — and the group has, on the National Motor Freight Traffic Association's account, worked its way down from national fleets to smaller regional fleets since October. Anyone who has worked for one of the named companies should watch for a breach notification rather than assuming one is coming quickly: the Echo suit's central complaint is precisely that affected people had not been told what was taken or how to protect themselves. Wilkens' recommendations to companies were specific — endpoint detection and response deployed, active and monitored on internet-facing web servers, and investigation of unexpected processes, webshell creation and unusual outbound connections. A carrier too small to run that stack still controls the basics the lawsuits argue about: encrypt or redact stored personal information, and patch the web servers the group is targeting.