Thieves took more than $100 million of AI hardware off US roads. Most of it was stolen with a login, not a gun.

Since June 2026, cargo thieves have stolen more than $100 million in hardware headed for US data centers. That is according to a count by Scott Cornell, who chairs the freight security group TAPA Americas. A security firm called Overhaul puts the losses of AI equipment even higher, at more than $150 million. Two of those loads, worth about $13 million and $10 million, were taken after the cars guarding them were rammed. In one of those cases, the truck's tracking signal had also been faked. Those are the stories getting attention, but they are rare. Overhaul says trickery was used in 92 percent of thefts of expensive tech. The FBI has also spelled out the usual method. Criminals hack the accounts of freight brokers and trucking companies and post fake jobs. Then they take over a real trucking company's identity and send a truck full of servers to a driver who works for them.

NBC News published the investigation behind this story on 26 October, and it spread fast. One post about it on X, from the account @IntCyberDigest, passed 131,000 views within a day. I went past the headline and read the FBI's own warning about this scheme, the industry's theft data, this year's changes to trucking rules and the related court cases. The highway robbery makes a good story. But what the documents describe is a paperwork problem, and that is the part worth understanding.

What actually happened, without the movie version

In early June, a trailer carrying about $13 million worth of server equipment was heading toward Fayetteville, Georgia. That town is home to one of the largest data center projects in the US. Two off-duty police officers had been hired to escort the truck. An unmarked car hit their vehicle, and the trailer drove on without them. A few weeks later, a load of server rack parts worth around $10 million was going from California to Texas. It lost its escort the same way, this time to an SUV. That load was being tracked by an app, but according to NBC, "the tracking coordinates had apparently been spoofed." Neither load has been found, and no arrests have been reported.

Gerardo Pachuca is a private investigator who used to be a sheriff's deputy in Los Angeles County. He told NBC that "the accident was not an accident. The bad guys wanted that load, so they intentionally took out the escorts."

There is less certainty here than the headlines suggest, and I think you should know that. Wired first reported the escort attacks in August, and it said both shipments were going "from Silicon Valley to Southern California." Wired also said it "could not independently confirm" the attacks with five different agencies. NBC's October version places the two loads on different routes. NBC also says the $13 million load was "several hundred pounds" of equipment, which is very light for that much money. In August, FreightWaves reported that Cornell himself warned against treating the two escort attacks as a nationwide trend. And on Slashdot, a doubter named SlashbotAgent called the headline "an Oceans Eleven fantasy." He wrote that "the actual article [is] more mundane than the headline."

He is right about the headline but wrong about the story, because the boring version is the dangerous one.

Where the "$100 million" number comes from

The $100 million figure is not an official government number. NBC credits it to "several industry leaders, consultants and investigators," and it lines up closely with one running count. In August, FreightWaves reported that Cornell had confirmed $110.6 million in known thefts since 3 June. Single cases ranged from $2 million to $38 million. If NBC's number comes from that count, then it stops in mid-August. Overhaul's October report says it has recorded "more than $150 million in AI equipment cargo losses," but it doesn't say over what time. Tom's Hardware's headline says "hundreds of millions," but the article underneath it doesn't back that up.

The wider data tells a clearer story than any of those headlines. Verisk CargoNet tracks cargo theft in the US and Canada. It counted 677 thefts in the second quarter of 2026, which is 26 percent fewer than a year earlier. But losses in the same three months more than doubled, from $135.7 million to $304.6 million, and the average theft was worth $564,009. CargoNet says computer and networking gear "frequently move through the supply chain as conventional dry freight." In plain words, these very expensive goods travel like ordinary boxes, with ordinary security.

So there are fewer thefts, but each one is much bigger. Thieves have stopped grabbing whatever is easy and started choosing what is valuable. CargoNet's Keith Lewis summed it up for NBC: "it's like stealing pure gold bars."

How the scheme actually works

The FBI described this exact plan in a public warning in April, months before the NBC story came out. It is worth reading in the FBI's own words, because it shows how little of this happens on the road.

Step one is a phishing email. The criminals send emails to freight brokers and trucking companies with links to "a carrier broker agreement" or to "review and address poor service ratings." Clicking the link installs real remote-control software, which gives the criminals "total, undetected access" to the company's computers. Step two is about fake jobs. The criminals post fake loads on the websites where trucking jobs are listed, "sometimes in the tens of thousands," and they use those to trap more trucking companies. In step three, they take over a real company's identity. They bid on real loads while pretending to be the company they hacked. To make it stick, they "change the legitimate carrier's contact information with the Federal Motor Carrier Safety Administration and update insurance information." Step four is the theft, when the load is moved to a driver who is in on it and then disappears. Sometimes, the FBI says, they even call the broker back "to demand a ransom for the location" of the load.

This is where a term called double brokering comes in, and more people are searching for it this week. Double brokering is when a trucking company, or someone pretending to be one, accepts a load and then secretly hands it to a different carrier. Fraud rings use this trick to get expensive freight into the hands of their own drivers.

The scheme has grown new parts since April. CargoNet warned in July that criminals are now "compromising cloud-based business phone systems." That lets them "make and receive calls using legitimate carrier telephone numbers." So the old advice to call the trucking company and check now only works if you use a number you already had before any of this started. In Connecticut, federal prosecutors have charged an Uzbek man, Nursulton Khaydarov, who was arrested in June and indicted in September. Prosecutors say he held fake driving licenses in five different names, each using "a photograph of Khaydarov, but with altered facial features." They say he was part of a ring that stole at least 24 loads.

The stolen gear is also often sold before it is even stolen. According to NBC's sources, "an overseas buyer is already lined up before the theft." On the Ars Technica forum, chanman819 summed it up: "it sounds like the gear is being stolen to order."

Why AI hardware is the perfect thing to steal

Three things make data center gear the best target on American roads right now.

The first is how much value fits in a small space. Overhaul says a top AI server rack costs about $3 million. So a single truckload can be worth tens of millions of dollars, and it still ships like ordinary boxes.

The second is that the same chip is worth more after it is stolen. Nvidia's B300 servers are not allowed to be sold in China. Reuters reported in April that they sell there anyway for about 7 million yuan, or around $1 million, which is nearly double the price elsewhere. Overhaul says "between 60 and 70 percent of loads stolen in the United States now leave the country," and China, Russia and Iran are among the places they go. Very few stolen goods are worth more on the black market than in a shop, but restricted AI hardware is one of them. The demand also shows up in court. In March, the US Justice Department charged three people over servers worth about $2.5 billion, and press reports named one of them as a co-founder of the server maker Supermicro. Prosecutors say at least $510 million of those servers went to China in a few weeks in 2025. To fool inspectors, the group allegedly used "a hair dryer to remove and affix labels and serial number stickers" on fake servers.

The third reason is the memory shortage. The research firm TrendForce says memory chip prices for big buyers rose about 80 percent in the second quarter of 2026 alone. Memory sticks and storage drives are small, have no big labels and are easy to resell. On the Ars Technica forum, fuzzyfuzzyfungus made the dark joke that many people were thinking. "Even if you need to pay the accomplices that sounds like the most cost effective way of shopping for DDR5 currently available," the comment read. People saw this coming months ago, too. In July, on the forum site Lemmy, a user named Marija wrote, "Copper theft has always followed expensive infrastructure. AI data centers are just the newest high-value targets." Another Lemmy user, echodot, added, "That's the problem with making RAM so expensive. It's not physically very big so you can fit a lot of it in a truck."

The weak point is a phone number, not a lock

This is where I think the official response is aimed at the wrong door. In March, the Federal Motor Carrier Safety Administration, or FMCSA, warned trucking companies not to sell or lease their USDOT and MC numbers. These are the ID numbers that let a trucking company carry freight. In May, the FMCSA launched a new sign-up system called Motus. New companies now need a Login.gov account, a government ID and a face scan, and the system also checks the business. Transportation Secretary Sean Duffy said the system "will stop fraud dead in its tracks."

The problem is that Motus checks who you are when you first sign up. The FBI's warning describes criminals taking over trucking companies that signed up years ago, and then changing their contact and insurance details. Those are two very different problems, and only one of them is being fixed. The company Highway, which checks carriers for brokers, counted 45,000 email changes and 63,000 phone number changes in FMCSA records. It estimated that about 3 percent of those changes were fraud. Then in September, the FMCSA had to warn carriers about four fake Motus websites. Those sites were pushed through phishing emails and aimed at stealing logins, which means the criminals are already copying the anti-fraud system itself.

So my callout is for the FMCSA, and for Secretary Duffy by name. Checking IDs at sign-up was a good step, but it doesn't touch the method the FBI says is driving this wave. Any change to a carrier's phone number, email or insurance should trigger the same identity check as a new sign-up. The old contact should also get a warning before the change goes live. Until that happens, "dead in its tracks" is just a slogan.

"Cargo theft is old news, and these numbers are small"

This is the fair pushback, and I take it seriously. Cargo theft is as old as cargo itself. Back in 2012, thieves took 3,600 iPad minis from JFK airport in New York. In 2025, total cargo theft in the US and Canada, across everything from food to copper, was about $725 million, according to CargoNet. On Slashdot, couchslug called that $725 million "a drop in the economic swimming pool." And as FreightWaves reported Cornell saying, the escort attacks are just two events.

But that argument counts the wrong thing. With AI hardware, what the boxes do and where they end up matter far more than their price. A stolen pallet of shoes is a loss for a shoe company. A stolen rack of restricted servers that ends up in China is a hole in a US policy that the government has spent years building. For the company waiting on that rack, the bigger cost is the delay. Power transformers for data centers already take more than two years to arrive, and builders plan around parts that are sold out months ahead. A stolen load of special equipment is not replaced next week.

The insurance gap makes it worse. Many standard cargo insurance policies treat handing a load to a fake carrier as "voluntary parting." That means the shipper gave the goods away by choice, even if it was tricked, so the policy doesn't pay. In one case that the insurance firm Coyle Group describes, the "insurer denied the claim because the policy only covered cargo entrusted to a legitimate motor carrier." Overhaul estimates that the indirect costs of a theft are about three times bigger than the direct loss. On the Ars forum, KrookedRooster asked the question I think most readers will end up asking. "So now the creation of credentials and IDs that used to be specialized, is automated. And the process of vetting, that used to be automated, now needs to be specialized. And somehow I'm the one footing both bills?"

This isn't only an American problem

India has no confirmed theft of data center cargo yet, and I found no link between the US cases and India. But the same pattern already shows up here in a smaller form. On 21 October, masked men broke into an Ingram Micro warehouse near Ahmedabad and took about ₹1 crore worth of iPhones, laptops and Apple Watches. Police said they couldn't rule out "someone familiar with the warehouse." In August 2025, a container truck carrying 255 laptops from Mumbai to Chennai was found at a dhaba in Bapatla, Andhra Pradesh. The laptops were gone, and the driver and cleaner were missing. That is the same weak point as the American escort cases, which is the person driving the truck.

India is building data centers quickly too, and the same servers, chips and memory will travel on the same kinds of highways. This month in Brazil, the electronics distributor Oderço reported that two pallets of RTX 5090 graphics cards had gone missing inside São Paulo's Guarulhos airport. The cards were worth about R$2.5 million, and the company said publicly that it had received "no answers." Police have not officially confirmed a theft there. But wherever scarce AI-related hardware sits still for a few hours, someone is now watching it.

What actually stops this

The fixes that work are older than the technology being stolen. The FBI's advice is to "independently verify shipment requests and pickups using secondary methods prior to releasing any loads." It also says to keep photos of drivers, licenses, license plates and DOT numbers. On X, a user called @sabatage put it in the plainest words I have seen: "This is account takeover with a forklift at the end." The same post gave the fix: "If you ship or receive expensive gear, confirm pickup and payment changes with a phone call to a number you already have."

Some fixes are simple design choices. On Slashdot, u19925 pointed out that a truck with three or more GPS receivers can catch a faked signal. That works because "the spoofed signals will give different readings on each of them." And some fixes are almost funny. In September, thieves in Fremont, California, stole two trailers with Nvidia logos on them. The trailers belonged to the self-driving truck company PlusAI, and inside was 40,000 pounds of sand, which PlusAI uses as test weight. "The very apparent branding probably made them think there was very valuable equipment back there," said Lauren Kwan from PlusAI. If you ship real AI hardware, the lesson is to make the truck look boring.

The AI industry likes to talk about its problems as big future problems, like power, chips and models. This one is a phone call that nobody made and a link that somebody clicked. The companies spending hundreds of billions on data centers can fix it with the cheapest tools they have. They just need to treat the trucking part of the trip as part of their own security, instead of somebody else's job.

My prediction

Verisk CargoNet's report for the third quarter of 2026 is due within days. It will show fewer cargo thefts than the third quarter of 2025, and an average loss per theft above $300,000. If thefts go up compared with last year, or the average comes in below $300,000, I was wrong.

I am betting on this for three reasons. The second quarter already showed thefts down 26 percent, with the average loss at $564,009. Overhaul says losses above $30 million now happen "regularly." And nothing in this year's FMCSA changes stops the account takeovers that the FBI says are driving the problem.

Questions people are asking

How much AI and data center hardware has been stolen in 2026? Scott Cornell, chair of TAPA Americas, counted $110.6 million in reported thefts between 3 June and mid-August 2026. Overhaul says it has recorded more than $150 million in losses of AI equipment.

How are thieves stealing data center shipments? In most cases they use fraud, not force. They send phishing emails to freight brokers and trucking companies and post fake jobs. Then they take over a trucking company's identity, change its details with the FMCSA and send the load to their own driver. Two cases involved ramming escort cars, and one involved a faked GPS signal.

What is double brokering? It is when a trucking company, or someone pretending to be one, accepts a load and then secretly hands it to another carrier without permission. Fraud rings use it to get freight into the hands of their own drivers.

What is GPS spoofing in cargo theft? A spoofer sends fake satellite signals that are stronger than the real ones. The tracker then shows the truck on its normal route while it actually goes somewhere else. Using several GPS receivers on one truck can catch it.

Where does stolen AI hardware go? Overhaul says 60 to 70 percent of loads stolen in the US leave the country, including to China, Russia and Iran. In China, restricted AI servers can sell for about double the normal price.

Does insurance cover cargo stolen by a fake carrier? Often it doesn't, because of a phrase called "voluntary parting." Many cargo policies refuse to pay because the shipper handed the goods to the fake carrier by choice.

What is the FMCSA doing about it? In March it warned trucking companies not to sell or lease their USDOT and MC numbers. In May it launched Motus, a sign-up system that checks identity with a government ID and a face scan. Since then, criminals have set up fake Motus websites and sent phishing emails pointing to them.