Insider Cargo Theft: A Bribed Employee, a Scraped Tracking Page, and 13 Charged
Insider cargo theft happens when someone with authorized access to shipments or shipment data uses that access to help steal freight, usually by passing on what is moving, where, and when. In a New Jersey federal case, prosecutors allege that a 13-person ring got that information two ways: by bribing a wireless carrier’s retail employees and by scraping public tracking systems with automated scripts.
TL;DR
- In February 2025, federal prosecutors in New Jersey charged 13 people in an alleged international ring that targeted shipments of iPhones, iPads and Samsung devices sent through FedEx and a major U.S. wireless carrier.
- Prosecutors allege the ring found its targets in two ways: automated scripts run against public tracking systems, and bribes paid to carrier retail employees for confidential order data.
- One defendant, Raimond Cabrera De Leon, pleaded guilty in July 2026 to conspiracy to receive and transport stolen goods, a conspiracy tied to more than $1.5 million in losses; the other twelve are presumed innocent.
- Truck GPS and geofencing would not have stopped this scheme, because the weak points were who could see the shipment data, not where any vehicle was.
- The lesson for fleets and shippers is to treat shipment visibility data as an attack surface: limit who inside can see it, limit what outsiders can see, and watch how it is being looked up.
Table of contents
- What is insider cargo theft?
- The case: how prosecutors say the ring worked
- Case timeline
- The numbers
- Shipment tracking data is an attack surface
- Warning signs of insider theft and data leakage
- How to prevent insider cargo theft: a checklist
- Which controls would have mattered here?
- An operational perspective on insider risk
- Where Admiral fits, and where it doesn’t
- FAQ
- Sources
What is insider cargo theft?
Insider cargo theft is the theft of freight carried out or enabled by someone with legitimate access: an employee, contractor or partner who takes goods or sells the information needed to take them. That information might be order records, tracking numbers, delivery windows or load details. The insider often never touches the freight.
The term combines two official definitions. The FBI’s Uniform Crime Reporting program defines cargo theft as the criminal taking of cargo that is, “in whole or in part, a commercial shipment of freight moving in commerce,” from any vehicle, facility or container along the way. CISA defines an insider as “any person who has or had authorized access to or knowledge of an organization’s resources,” and insider threat as the potential for that person “to use their authorized access or understanding of an organization to harm that organization.”
CISA also names the pattern that fits this case: collusive threats, “where one or more insiders collaborate with an external threat actor to compromise an organization.” The employee provides the knowledge and the outside crew does the stealing.
The case: how prosecutors say the ring worked
Most cargo theft stories start at a dock or a trailer. This one starts on a tracking page. In February 2025, the U.S. Attorney’s Office for the District of New Jersey announced charges against 13 people in what it called an international ring targeting cell phone shipments. Then-Acting U.S. Attorney Vikas Khanna said the defendants “are alleged to have worked together as part of an international ring to steal thousands of expensive electronic devices.” The targets were mostly iPhones, iPads and Samsung devices moving through FedEx and a carrier that the filings call “Victim-1,” described only as a major U.S. cellular provider. The filings do not name that carrier, and neither does this article.
According to the charges, the ring found its targets through two separate channels that produced the same result:
- Automated scraping. Prosecutors allege members built and ran automated scripts against the public, customer-facing package-tracking systems of FedEx and Victim-1 to work out which tracking numbers belonged to high-value electronics. Demetrio Reyes Martinez, 37, of the Dominican Republic, who prosecutors say went by “CookieNerd,” is alleged to have been an organizer of that effort. How the scripts worked has not been made public, and this article will not speculate.
- Insider bribery. Prosecutors allege members paid bribes to Victim-1 retail employees for confidential customer order data, including names, tracking numbers and delivery addresses that were never meant to be public. Two defendants, Alejandro Then Castillo, 45, of Paterson, N.J., and Wilson Peralta Tavarez, 28, of Belleville, N.J., are named in the charges as the bribed employees.
What prosecutors describe next is an assembly line in which the person who found a package was not the person who took it. “Dispatchers,” whom the charges name as Edickson Lora Castillo, Frederick Duverge Guzman and Julio Vasquez Sanchez, allegedly compiled the delivery details (name, address, tracking number, expected delivery window) and sold them to “runners.” The runners, named as Ecker Montero Hernandez, Luis Nunez and Jean Luis Diaz Dominguez, allegedly used that information to steal the packages. No public source says how the runners physically got the packages, and this article will not fill that gap.
The phones allegedly went to two collection points. One was a residential building in the Bronx, which one release describes as receiving an “almost constant stream” of people bringing in stolen electronics. Prosecutors allege it was run by Andrickson Jerez, Raimond Cabrera De Leon and Luis Marte Tavares. The other was in Brooklyn, allegedly run by Joel Suriel, and received bulk deliveries of devices stolen nationwide. From there, filings say, the devices went into black-market resale.
HSI Acting Special Agent in Charge Michael Alfonso said “these accused criminals tailored their alleged scheme to the modern times.” Nothing was broken into: one way in was a website anyone could reach, the other an employee who could allegedly be paid.
Where the case stands. One of the thirteen has been convicted. On July 16, 2026, Raimond Cabrera De Leon, 33, of New York, pleaded guilty before U.S. District Judge Jamel K. Semper in Newark to conspiracy to receive and transport stolen goods, admitting his role in a conspiracy tied to more than $1.5 million in losses. No sentencing date has been reported. The other twelve defendants are charged only and presumed innocent. No trial dates, other pleas or dismissals have been reported for any of them.
Case timeline
| Date | Event | Source |
|---|---|---|
| 2024 | New Jersey identifies 400+ package thefts targeting cellular devices | USAO-NJ release (Feb. 2025) |
| 2024 | Union County Prosecutor’s Office, NJ State Police and FBI Newark form a multi-agency task force | USAO-NJ release (Feb. 2025) |
| ~Feb. 25, 2025 | Arrests and charges carried out against the network | Bronx News12; USAO-NJ |
| Feb. 2025 | Acting U.S. Attorney Vikas Khanna announces 13 people charged | USAO-NJ; Cranford PD release via piowire |
| July 16, 2026 | Raimond Cabrera De Leon pleads guilty in Newark federal court | USAO-NJ release (July 2026) |
| July 28, 2026 | Plea announcement republished by LongIsland.com (exact DOJ release date unconfirmed) | LongIsland.com |
The numbers
| Figure | What it measures |
|---|---|
| 13 | People charged in February 2025 |
| 1 | Guilty pleas confirmed (Cabrera De Leon, July 2026) |
| $1.5M+ | Losses tied to the conspiracy Cabrera De Leon admitted |
| 400+ | NJ package thefts targeting cellular devices in 2024 (a separate figure from the $1.5M) |
| 5 yrs / $250,000 | Maximum penalty, conspiracy to receive and transport stolen goods (all 13) |
| 20 yrs / $250,000 | Maximum penalty, wire fraud conspiracy (Then Castillo, Peralta Tavarez) |
| 10 yrs / $250,000 | Maximum penalty, transportation of stolen property (Jerez, Then Castillo, Lora Castillo) |
HSI, the FBI, the NYPD, the Union County Prosecutor’s Office, New Jersey State Police and the Dominican Republic’s high-tech crimes prosecutor’s office (PEDATEC) took part, alongside dozens of other agencies. FBI Acting Special Agent in Charge Terence G. Reilly said investigators “will break the chain of criminality and bring the perpetrators to justice.”
Industry backdrop, with a caveat. The FBI’s IC3 reported in April 2026 that estimated U.S. and Canada cargo theft losses reached nearly $725 million in 2025, a 60% increase from 2024, and that the average value per theft rose 36% to $273,990. Verisk CargoNet counted 2,646 confirmed incidents. Those numbers mostly reflect truckload freight theft, not parcel schemes like this one, and CargoNet found consumer electronics theft fell within truckload theft in 2025. This ring is a different pattern, not an example of the national trend.
Shipment tracking data is an attack surface
Every tracking page, customer portal, load-board post and order record tells someone what is moving, where it is and when it arrives. Customers need that information; thieves can use it too. Prosecutors allege this ring got it from two places rarely treated as security controls: a public tracking interface and an employee’s access to order data.
Three defensive questions matter:
- What does an outsider learn from one lookup? A tracking page that shows contents, a high-value carrier service or a precise delivery window reveals more than a page that shows only “in transit.” OWASP lists scraping as a recognized automated threat to web applications: collecting “application content and/or other data for use elsewhere.”
- What can one insider see? If a store or desk employee can pull any customer’s full order, address and tracking number, one bribe exposes all of it.
- Would anyone notice unusual use? Large volumes of lookups, or an employee viewing records unrelated to their own customers, leave traces only if someone records and reviews them.
None of this is fleet hardware. It is data governance, and it belongs in the same risk discussion as locks and seals.
Warning signs of insider theft and data leakage
- Losses concentrated on high-value SKUs or services, when ordinary shipments on the same routes arrive fine.
- Thefts that happen close to the delivery window, suggesting the thief knew the timing in advance.
- An employee account that views far more customer or shipment records than its role or workload explains.
- Lookups of orders or loads outside the employee’s own store, region, accounts or shift.
- A surge of automated-looking requests to a tracking page or customer portal, especially for tracking numbers no customer has asked about.
- Load or customer details turning up in places they shouldn’t, such as a broker or caller who knows specifics you never shared with them.
How to prevent insider cargo theft: a checklist
- Apply least privilege to shipment and order data. Why: if one employee can see only what their role needs, bribing them exposes far less.
- Log and review who viewed which records. Why: insiders count on lookups going unnoticed; a reviewed access log takes that away.
- Show outsiders as little as possible on public tracking. Show status and hide contents, value indicators and precise windows unless the viewer is authenticated. Why: scraping works only if each lookup returns something valuable.
- Ask your IT or platform provider for bot and abuse controls on tracking lookups. Rate limits and automated-traffic detection are standard. Why: this targets the scraping vector without any change to field operations.
- Separate the people who know about a high-value load from the people who could act on it. Why: the alleged ring relied on handing information from finder to runner; fewer people who know means fewer points of sale.
- Verify every request to change pickup, delivery or release details through a second channel. Why: leaked data makes impersonation believable, and the FBI’s IC3 recommends independent verification of shipment requests before releasing loads.
- Make reporting easy and safe. Why: coworkers often notice odd data access first, so give them a way to say so.
Pro Tip: Every quarter, pull the ten accounts that looked up the most high-value shipments and ask each one’s manager whether that volume makes sense. It takes an hour, and it is the review a collusive insider most wants you to skip.
Which controls would have mattered here?
| Control | Addresses scraping? | Addresses insider bribery? | Relevance in this case |
|---|---|---|---|
| Real-time GPS on the delivery vehicle | No | No | The packages were routed to real addresses; tracking the van would show a normal route |
| Route-deviation alerts and driver cameras | No | No | No source suggests delivery drivers were compromised or diverted |
| Trailer or load-level GPS tags | No | No | This was individually addressed retail parcels, not truckload freight |
| Rate limits, bot detection, authenticated tracking detail | Plausibly | No | Owned by the tracking-system operator’s IT and fraud teams |
| Least-privilege access to customer order records | No | Plausibly | A data-governance control at the retailer or carrier |
| Auditing of record lookups | Partly | Plausibly | Supports both detection and investigation |
The two controls that plausibly would have blunted this scheme are web security on the tracking system and access governance on the order data. No vehicle-tracking product does either. The public record does not say how investigators identified the ring.
An operational perspective on insider risk
Our industry spends heavily on learning where freight is and very little on controlling who else gets to learn it. If prosecutors are right, the ring did not need to defeat a truck, a lock or a driver. It needed one data source a script could read and one employee it could pay. Both were already open.
I think this reframes insider theft for carriers and shippers. We usually picture the insider as the person who drives off with the trailer. The more scalable insider is the one who sells the schedule. Their access is legitimate, their lookups look like work, and the loss shows up miles away on someone else’s report. You can’t fence your way out of that. You reduce it by making access narrow, making it visible, and making sure that knowing where freight is does not mean being able to take it.
Physical enforcement still matters, but as the third layer. Data discipline comes first.
— Gwagsi Glenn, Growth Analyst, Level5Fleet
Where Admiral fits, and where it doesn’t
To be direct: Admiral would not have prevented, shortened or helped recover the losses in this case. The scheme targeted individually addressed retail parcels through a public tracking system and a wireless carrier’s internal order data. Admiral sits in front of neither; it is not a customer-data access control, a bot-detection layer or a parcel product.
| Admiral capability | Prevented this case? | Shortened it? | Aided recovery? |
|---|---|---|---|
| GPS location and movement data | No | No | No |
| Admiral Enforce (on-asset lock and immobilizer authorization) | No | No | No |
| Admiral Resolve (identity verification of requests) | No | No | No |
The general lesson does apply to truckload operations, where Admiral is built to work. When load data leaks, through an insider or an exposed portal, the thief knows which trailer to target. Admiral Enforce puts authorization on the trailer itself, so the asset checks presented credentials against its policy before allowing door access or movement. Level5Fleet describes this as “preventing unauthorized hookups, in-transit misdirection, and mis-pulls.” Admiral Resolve verifies that a request for a pickup, access or change comes from the real person, acting for the right company and authorized for that load, before you approve it, and it records the decision as an audit trail. Neither stops data from leaking; together they aim to make leaked data less useful.
Resolve is free to start, with no hardware or contract. If you want to see what verified authorization looks like on your own lanes, start with Admiral Resolve or request an Enforce Pilot.
FAQ
What is insider data theft?
Insider data theft is when someone with authorized access to an organization’s systems takes, misuses or sells its data. In freight, that often means order records, tracking numbers, addresses or load schedules, which can lead thieves straight to the goods. In the New Jersey case, prosecutors allege retail employees were bribed for exactly this kind of data.
What is cargo pilferage?
Cargo pilferage usually means stealing part of a shipment, such as a few cartons or units, rather than the whole load. The FBI’s cargo theft definition covers freight taken “in whole or in part.”
Were FedEx drivers involved in this theft ring?
No public source in this case suggests FedEx or carrier drivers were compromised, impersonated or diverted. FedEx is described as a victim whose public tracking system was allegedly scraped, and the employees allegedly bribed were retail employees of the unnamed wireless carrier.
Is cargo theft a federal crime?
Yes, it can be. Under 18 U.S.C. § 659, stealing goods from an interstate or foreign shipment, including from trucks, trailers, warehouses and terminals, is a federal offense with a maximum of 10 years in prison (3 years if the value is under $1,000). Knowingly receiving or possessing those goods is also covered.
How do you prevent insider theft in a supply chain?
Start with least-privilege access to shipment data, reviewed logs of who looked up what, and minimal detail on public tracking. Then make sure any change to a pickup or release is verified through a second channel. Insider theft depends on access going unnoticed, so the goal is to make it narrow and visible.
Sources
- U.S. Attorney’s Office, District of New Jersey, “Thirteen Individuals Charged As Part Of International Ring Targeting Cell Phone Shipments For Theft” (Feb. 2025): https://www.justice.gov/usao-nj/pr/thirteen-individuals-charged-part-international-ring-targeting-cell-phone-shipments
- U.S. Attorney’s Office, District of New Jersey, “New York Man Admits his Role as Part of International Ring Targeting Cell Phone Shipments for Theft” (July 2026): https://www.justice.gov/usao-nj/pr/new-york-man-admits-his-role-part-international-ring-targeting-cell-phone-shipments
- LongIsland.com, “FBI: New York Man Admits his Role…” (July 28, 2026): https://www.longisland.com/news/07-28-26/fbi-new-york-man-admits-his-role-as-part-of-international-ring-targeting-cell-phone-shipments-for-theft.html
- Cranford Police Department release via piowire.com: https://piowire.com/cranford-police-department/pressrelease/thirteen-individuals-charged-as-part-of-international-ring-targeting-cell-phone-shipments-for-theft
- Bronx News12 (Feb. 27, 2025): https://bronx.news12.com/sources-cellphones-stolen-from-long-island-connected-to-international-theft-ring-uncovered-in-the-bronx
- FBI Uniform Crime Reporting, Cargo Theft, 2019 (definition of cargo theft): https://ucr.fbi.gov/crime-in-the-u.s/2019/crime-in-the-u.s.-2019/additional-data-collections/cargo-theft/cargo-theft.pdf
- CISA, “Defining Insider Threats”: https://www.cisa.gov/topics/physical-security/insider-threat-mitigation/defining-insider-threats
- FBI IC3 Public Service Announcement, April 30, 2026: https://www.ic3.gov/PSA/2026/PSA260430
- Verisk CargoNet, “Cargo Theft Losses Surge to Estimated $725 Million in 2025”: https://www.verisk.com/company/newsroom/cargo-theft-losses-surge-to-estimated-$725-million-in-2025-verisk-cargonet-analysis-reveals/
- Overdrive, “Cargo thieves shifted to high-value theft in 2025: CargoNet”: https://www.overdriveonline.com/life/article/15815340/cargo-thieves-shifted-to-highvalue-theft-in-2025-cargonet
- OWASP Automated Threats to Web Applications, OAT-011 Scraping: https://owasp.github.io/www-project-automated-threats-to-web-applications/assets/oats/EN/OAT-011_Scraping
- 18 U.S.C. § 659 (Cornell Legal Information Institute): https://www.law.cornell.edu/uscode/text/18/659