Verisk CargoNet, a Verisk business and leader in cargo theft prevention and recovery, recorded 767 supply chain crime events across the United States and Canada in the first quarter of 2026, a 5.3% decrease from the first quarter of 2025 and a 12.2% decline from the fourth quarter of 2025. 

Despite fewer incidents, estimated losses reached $131.58 million, essentially unchanged from the first quarter of 2025, and confirmed cargo theft reports rose by 41 incidents to 596 of 767 total events. 

Verisk CargoNet’s first-quarter analysis points to a clear pattern: reduced activity from domestic criminal organizations, particularly in Texas and the Southeast, paired with sustained or growing activity by organized crime groups with a nexus in California and the New York City metropolitan area. 

This shift is reflected not only in where cargo theft is occurring, but in what is being stolen and how. 

Geographic Shift Driven by Organized Crime 

Among the top eight states for cargo theft, most saw year over year declines—with two notable exceptions. California increased from 255 to 277 incidents, and New Jersey surged from 27 to 59, a 119% jump that continues the trend identified in Verisk CargoNet’s third quarter of 2025 analysis. 

Both states are primary operating environments for organized crime networks, offering dense logistics infrastructure and proximity to major consumer markets. 

Meanwhile, Texas declined from 102 to 80 incidents, a 22% drop. The types of opportunistic theft historically common in the Dallas–Fort Worth and Houston logistics corridors appear to be giving way to more targeted operations elsewhere in the country. 

What’s Being Stolen?

Personal care and beauty products saw the quarter’s sharpest increase, jumping from 18 events in the first quarter of 2025 to 50—a rise of 178%, driven by cosmetics and fragrances, predominantly in the Northeast. 

Within food and beverage, which remained the top category at 144 events, the composition shifted: beverage theft declined while seafood targeting climbed sharply. 

Building materials fell from 21 events to 8, a category historically dominated by domestic groups operating seasonally in North Texas. 

Categories such as building materials, apparel, and vehicle-related shipments declined year-over-year - goods that are bulkier, less standardized, or more difficult to resell at scale. 

“The overall drop in incident volume is encouraging, but the underlying data tells a more complex story,” said Keith Lewis, vice president of operations at Verisk CargoNet. “We’re watching transnational organized crime groups become the dominant force in the cargo theft landscape, with a clear preference for goods that move easily through online resale channels. The geography is following the criminals.” 

Theft Through Impersonation

The most significant tactical development in the first quarter of 2026 is the maturation of impersonation-based theft into a systematic, scalable criminal methodology. Anti-fraud solutions deployed across the industry have been effective, and that success is now driving the next wave of innovation by criminal networks seeking to evade those controls. 

To bypass anti-fraud tools, criminal networks have largely settled on impersonating legitimate motor carriers and logistics brokers. 

They accomplish this through two primary methods. 

The first is credential harvesting: advanced phishing campaigns and remote access trojans are used to compromise business email accounts, internet-based phone systems, and the industry applications that carriers and brokers use to find shipments and verify their identity. 

With these credentials in hand, a criminal network can operate as a legitimate carrier, accepting tenders, communicating with logistics brokers, and redirecting loads under a trusted, seemingly verified identity. 

The second method is outright acquisition of motor carrier businesses. 

Criminal networks are purchasing legitimate carriers through social media, peer-to-peer marketplaces, and specialized brokerage services. Despite warnings from regulators, these sales remain frequent and largely unregulated. Verisk CargoNet warns existing motor carriers that selling an operating authority to a criminal network, knowingly or unknowingly, may expose owners to civil and criminal liability. 

“The anti-fraud tools the industry has deployed are working; they’re forcing criminals to invest more in elaborate schemes,” Lewis said. “But the shift toward credential theft and carrier impersonation means the industry needs to think beyond tender phase controls. We need robust identity verification throughout the lifecycle of a shipment, from booking to delivery.” 

Verisk CargoNet expects impersonation-based fraud and the exploitation of legitimate carrier identities to remain central to cargo theft activity in the coming quarters. As anti-fraud controls continue to improve at the point of tender, criminal networks are likely to expand their focus to vulnerabilities across the full shipment lifecycle.  

Current patterns suggest that organized groups will continue to prioritize high-value, easily redistributable goods while concentrating on activity in major logistics hubs that support rapid movement and resale. 

Verisk CargoNet’s Methodology  

All comparisons use Verisk CargoNet’s delayed reporting adjustment: first quarter 2026 data updated through April 14, 2026, compared with fourth quarter 2025 data updated through January 14, 2026, and first quarter 2025 data updated through April 14, 2025.