Transport and logistics under attack

A cyberattack on a transport operator can cause nearly 12 hours of disruption, with consequences stretching from delayed passenger journeys to freight stranded in warehouses and distribution hubs.

New global research from cybersecurity company Kaspersky and VDC Research reveals that 68% of transport and logistics organisations surveyed experienced measurable financial losses from cybersecurity incidents.

More than 40% estimated that the financial damage from an individual incident exceeded $1-million.

The findings, published in a study titled Driving Cyber Resilience Across Transportation and Logistics, raise concerns about the growing dependence of the travel industry on interconnected digital systems.

Airports, airlines, rail networks and other transport operators increasingly rely on technology to coordinate operations and keep passengers moving. A failure in one system can create delays across multiple services, particularly when operators depend on shared infrastructure.

The study found that transport and logistics organisations are preparing for a dramatic increase in digitalisation.

Currently, fewer than 5% consider themselves fully digital. Within the next two years, 68% expect to have reached that level.

This transformation promises greater efficiency, allowing operators to monitor vehicles in real time, predict maintenance requirements and manage transport terminals through centralised systems.

For travellers, digitalisation can make journeys more convenient through real-time travel updates, improved scheduling and faster processing at transport facilities.

However, connecting more systems also increases the opportunities for cybercriminals to interfere with operations.

A successful attack on an airport’s operational systems, for example, could interfere with passenger processing or baggage handling. Disruption to railway control systems could affect services across an entire network.

While the research covers the broader transport and logistics sector, its findings have clear implications for passenger transport, where operational interruptions can affect thousands of travellers.

The study found that improving network efficiency was the biggest driver of digital investment, cited by 31% of organisations.

Another 27% identified stronger cybersecurity as a priority, while 16% wanted to introduce new business models. Reducing operating costs motivated 10%.

Cybersecurity concerns were also the biggest obstacle to adopting digital technology, cited by 36% of respondents.

Problems coordinating different stakeholders were identified by 28%, while shortages of skills and staff, along with limited budgets, were each reported by 26%.

These difficulties are particularly relevant to international travel, where passengers and baggage can pass through several operators, airports and national jurisdictions during a single journey.

An airline may depend on airport systems for check-in and boarding, while baggage handling and other ground services may be managed by separate companies.

Each organisation may have different security systems and procedures, increasing the complexity of protecting the overall operation.

The research identifies operational technology, or OT, as a major area of concern.

Unlike ordinary office computer systems, OT controls physical equipment and industrial processes. Intransport environments, this can include automated baggage systems, warehouse machinery and equipment used to coordinate terminal operations.

Almost half of respondents (48%) identified keeping OT equipment updated with security patches as their biggest cybersecurity challenge.

Updating these systems can be difficult because many transport operations run around the clock, leaving limited opportunities to shut down equipment for maintenance.

A further 36% reported a shortage of personnel with specialised OT cybersecurity knowledge.

The study also found a division between the teams responsible for technology security and those managing day-to-day transport operations.

In 54% of organisations, IT teams were responsible for OT cybersecurity policies, compared with only 12% where operational technology teams led those decisions.

This can create difficulties when security teams need to update systems that operational staff depend on to keep services running.

In an airport, for example, taking baggage equipment offline for maintenance may affect flight operations and passenger connections. Delaying a necessary security update can leave equipment exposed to cyber threats.

The consequences can extend beyond the initial interruption.

The study found that cybersecurity incidents caused an average operational disruption of nearly 12 hours.

In interconnected transport networks, delays can continue after systems are restored. Aircraft, vehicles and personnel may be out of position, while missed connections and accumulated freight require additional time to clear.

For passengers, this can translate into disrupted itineraries, missed onward journeys and additional travel expenses.

The complexity grows in international travel, where operators must coordinate across different countries and regulatory environments.

Kaspersky recommends that transport organisations incorporate cybersecurity into their operational planning, with security measures designed to accommodate equipment that must remain available throughout the day.

The company also advocates closer monitoring of industrial systems to identify suspicious activity before it interferes with physical operations.

The research found that service and support capabilities, together with total cost of ownership, were the most frequently cited factors when organisations selected cybersecurity suppliers, each mentioned by 58% of respondents.

Kaspersky offers its Industrial CyberSecurity platform as one approach to protecting these environments, combining industrial network monitoring with equipment protection and threat detection.

The research also highlights growing demand for security specialists who understand both computer networks and the physical systems they control.

For airlines, airports and other transport operators, such expertise will become increasingly valuable as more activities depend on connected technology.

The move towards fully digital operations could provide travellers with better information and smoother journeys, but the financial cost of cyber incidents is already substantial.

With more than 40% of affected organisations estimating losses exceeding $1-million per incident, and average interruptions approaching half a day, the industry’s investment in digital systems is creating an equally urgent need to protect them.

• The full Kaspersky and VDC Research report, Driving Cyber Resilience Across Transportation and Logistics, is available online.