When a major storm hits, everyone goes into response mode.

• Are the drivers safe?
• Are the roads even passable?
• Is the equipment upright and where it’s supposed to be?
• What’s damaged, what’s delayed, and how fast can we get moving again?

That’s where the attention goes, and it should. Human safety first. Always.

But here’s the part that doesn’t get talked about enough: Once the winds die down, the snow stops, or the floodwaters recede, that doesn’t mean the risk disappears. In many cases, it goes up.

That was one of the biggest takeaways from my conversation with Danny Ramon, director of intelligence and response at Overhaul. His team tracks cargo theft trends across the supply chain, and what they see after large-scale weather events is consistent. Overhaul recorded 2,576 cargo theft incidents across the U.S. in 2025, about 7 thefts per day and a 16% increase from the previous year, highlighting how persistent the problem has become for freight operators.

“Cargo theft risk is going to increase in areas where law enforcement efforts are stretched thin by disaster response,” he said. “Criminals know this, and they know that property crime often falls lower down on the totem pole of priorities for law enforcement.”

Read that again.

The storm might be over. But law enforcement may still be directing traffic, handling rescues, or responding to emergencies that are, rightfully, higher priority than freight.

Criminals know that, and they plan accordingly. The concentration of cargo theft in major logistics states also adds pressure during emergencies. California accounted for 38% of U.S. cargo theft incidents in 2025, while Texas represented another 20%, according to Overhaul’s annual report.

The Restart Phase is Where Things Get Messy

We tend to think the disruption itself is the most dangerous part. Everything stops, trucks park, and schedules blow up.

But Ramon pointed out something that should give every fleet operator pause.

“Very often there’s not a plan in place,” he said. “And a lack of a plan can create chaos, and chaos breeds vulnerability.”

It’s not the weather alone; it’s the restart.

Picture this: Dispatch is trying to reroute, drivers are waiting for direction, and yards are congested. Temporary parking becomes semi-permanent. And loads are getting staged in places that were never designed for dwell time.

And in that window, when everyone is trying to assess and catch up, criminals are not waiting for clarity.

“They run their businesses like corporations,” Ramon explained, “but they don’t have the operational overhead. They’re not making decisions by committee. They’re not waiting for board approval. They can move a lot more quickly.”

That line stuck with me.

Most legitimate operations are built for stability. Criminal operations are built to exploit instability. When we’re recalibrating, they’re already moving. And that’s the blind spot.

Cargo at Rest is Cargo at Risk

If there’s one phrase fleets should tape to the wall before the next winter storm or hurricane season, it’s this: “Cargo at rest is cargo at risk.”

Ramon said it more than once, and it applies across the board.

“It doesn’t really matter what it is that’s stopping the cargo from moving,” he shared. “It just matters that it has stopped moving. And the longer it’s at rest, the higher the risk gets.”

Data backs up that concern. Overhaul found that warehouses and distribution centers accounted for 36% of cargo theft incidents in 2025, while truck stops and fuel stations represented another 17%, locations where freight often sits while operations reset.

Think about what that looks like operationally.

• Truck stops are packed because high winds shut down a corridor.
• Overflow yards are filled beyond normal capacity.
• Trailers are staged in temporary lots while routes are reassessed.
• Drivers stay in the cab because conditions make outside inspections unsafe.

Criminals are not deterred by discomfort. In fact, bad weather can work in their favor.

“We know that under the cover of night and during storms, we definitely see pilferage increase,” Ramon said. “It provides that extra layer of cover.”

Timing also favors thieves. The early-morning window between midnight and 6 a.m. accounted for roughly 26% of all cargo theft incidents in 2025, the single largest time block recorded.

Even high wind advisories can shift the risk equation. Criminal groups know the sustained wind thresholds for parking commercial vehicles. They know when truck stops will be full.

“They study trends,” he said. “They know it’s going to increase their chances.”

So, that means they’re watching the weather, too. And probably more closely than you think.

It’s Not Always the High-Dollar Load You Think It Is

A lot of people still assume cargo theft is mostly about the highest-dollar loads. That used to be truer than it is today.

“For a long time, cost density was the main driver,” Ramon said. “But post-2020, we’ve seen criminal behavior shift. Now the main driver is ease of liquidation. How quickly can they get rid of the evidence? How quickly can they convert their ill-gotten goods into cash?”

That changes everything. A $250,000 load of electronics sounds like the obvious target. But if that product requires layers of resale, multiple go-betweens, and time to move, it may be less attractive than something of lower value that can be sold directly to end users.

We saw that play out during the pandemic. Everyday goods suddenly became high-demand, high-opportunity targets. Memories of toilet paper shortages, anyone?

And it’s not just crisis goods. Ramon pointed out that they consistently see a spike in avocado theft in the two weeks leading up to the Super Bowl. Roughly 90% of U.S. avocados are imported from Mexico, and a massive share of annual consumption happens around that one weekend. Criminals know that the equation requires high demand, fast resale, and predictable timing. That’s the formula.

The point for fleets is not to panic about every pallet. It’s to understand that what’s “low risk” in normal times may not stay that way during disruption and recovery. Demand and priorities shift, and so does criminal targeting.

Temporary Staging is Not Neutral Ground

After a storm, freight doesn’t go back to normal in a neat, organized way. It backs up. It gets rerouted. It sits longer than anyone planned.

So, loads get staged wherever there’s room. Overflow yards are full. Hubs are jam-packed. And extra trailers are tucked into lots that were never meant to be long-term parking. All because you’re trying to keep things moving and everyone’s making the best calls they can in real time.

And that’s the catch: those “good enough for now” staging setups are exactly what criminals look for.

Ramon described organized pilferage crews capable of emptying a 52-foot trailer in under 10 minutes. Not “maybe if they get lucky.” Ten minutes.

“They know how many box trucks it takes to empty a 52-foot trailer,” he said. “They will do exactly that. And then they’ll cross multiple states on the way home.”

This isn’t smash-and-grab chaos. These are organized crews who treat cargo theft like a business. They study routes, dwell patterns, and understand where visibility drops and enforcement is thin. And they move accordingly.

And this is the part that changes how you should think about the risk. Because in your head, you might be thinking, “Okay, worst case scenario, someone steals the truck or the trailer. We report it, and then law enforcement can go look for it.”

But that’s not always what’s happening. Sometimes the tractor and trailer are still there when police arrive. It’s just… empty.

“If the tractor and trailer are gone, they can pursue the tractor and trailer,” Ramon said. “If they show up and the tractor and trailer are there and empty, what are they chasing?”

That’s why temporary staging isn’t neutral. It’s not just “parking”; it’s creating a moment when cargo sits still, visibility drops, and the odds tilt against you. Locking doors matters, sure, but the bigger issue is how quickly these environments can turn into opportunities.

Just Because Roads are Open the Risk Isn’t Gone

One of the easiest traps during recovery is seeing “roads open” and translating that into “okay, we’re back.”

But “open” doesn’t always mean normal. It can mean one lane is moving. It can mean detours that funnel everyone into the same pinch point. It can mean limited places to pull off, park, fuel, or regroup safely. It can mean drivers sitting longer than expected because the network is technically running, just not smoothly.

And when freight is slowed down, staged, or forced into predictable choke points, the risk picture changes. When trucks stack up in the same places, at the same times, patterns emerge. And patterns are exactly what organized theft crews look for. Ramon boiled it down to two signals fleets should watch before relaxing.

First, road conditions. Not just whether a route is technically passable, but whether traffic is flowing, whether safe stopping options exist, and whether you’re still dealing with rolling closures and congestion.

Second, law enforcement capacity.

“Law enforcement capacity is the thing criminals are looking at,” he said. “Every calculation they do comes down to how likely it is that law enforcement is going to catch them.”

If officers are still pulled into recovery work, traffic direction, rescues, or just handling a backlog of higher-priority calls, property crimes can get pushed down the list. So yes, the system might look operational on paper. But if it’s operating with reduced visibility, reduced capacity, and a lot of freight sitting still, it’s not actually stabilized.

The Pressure to Catch Up Can Create New Exposure

After any disruption, there’s pressure to move. To clear backlogs. To make customers whole. To get trucks rolling.

But speed without structure is where mistakes creep in.

“You can’t treat all legs of your supply chain the same,” Ramon said. “Depending on where it is and what’s in the back of the trailer, you’re facing different criminals and different tactics.”

That means risk assessment must happen before the storm, not during it.

Fleets should know which lanes, facilities, and cargo types are most vulnerable. Drivers should have clear inspection checklists. And dispatch should know which items get escalated first.

“Knowing what order that needs to happen in is going to save you so much time,” he said. “If you know these are our super high-risk things, we need to address these first, then you can move down the list.”

Otherwise, recovery becomes reactive, and reactive environments are where blind spots grow.

Take Practical Steps That Really Matter

Disaster planning isn’t just a binder on a shelf that someone dusts off once a year. It’s physical. It’s operational. It’s detailed in a way that feels almost excessive until you actually need it.

It starts small, making sure drivers have adequate supplies in their cabs so they don’t become the emergency. This should include extra food and water, and cold-weather gear when it’s relevant.

Because, as Ramon pointed out, human safety will always be at the top of the priority list, and it should be. But if you can prevent something from escalating into a rescue situation, you preserve capacity for everything else that needs attention.

“Dig your well before you’re thirsty,” he said.

That applies beyond driver prep. It means vetting parking locations before you’re forced to use them. It means knowing which truck stops your drivers consistently rely on and understanding the environment around them. It means building relationships with local law enforcement in those areas long before you’re dialing a number in a crisis.

If you already know who handles property crimes in each jurisdiction, you’re not waiting in a generic queue when something goes wrong.

And if you ship serialized products, make sure those records aren’t buried three systems deep. If freight is recovered, proof of ownership will hinge on your ability to produce that documentation quickly and accurately.

You don’t want to be figuring out where those numbers live while product is sitting in an evidence warehouse. And the onus of proof will be on you.

The Overlooked Piece in Disaster Recovery

When I asked Ramon what fleets most often overlook, he didn’t hesitate.

It comes down to treating the entire supply chain as carrying the same level of risk.

Too many organizations apply a single security posture across every lane, every product, and every region, because it’s easier to manage that way. But risk doesn’t operate evenly. It shifts by:

1. Geography.
2. Season.
3. Demand.
4. What’s happening in the world that week.

“You can’t treat all legs of your supply chain the same,” Ramon said earlier in our conversation, and that line really ties this whole discussion together.

If something is making money for you, someone else is likely calculating how to make money off it, too. And that calculation changes depending on where it’s sitting, how long it’s sitting there, and what else is competing for attention at that moment.

Storms will keep coming, and recovery phases will keep happening. Disruption isn’t rare anymore; it’s part of the operating environment.

The goal isn’t to eliminate risk; that’s not realistic when you are talking about extreme weather or natural disasters. The goal is to recognize that when the storm clears and everyone exhales, that’s not the moment to move on mentally.

Because remember, cargo at rest is cargo at risk. And the restart phase, messy and improvised as it can be, may be the most vulnerable part of all.