Freight & warehouse ransomware

The threat

An attacker encrypts the TMS and WMS that route and pick every shipment. Trucks queue, perishable goods age, and dozens of partners and customers demand certainty you don't yet have.

Key injects

• 01The warehouse management system locks; pick lines stall.
• 02A carrier partner asks whether to reroute in-transit freight.
• 03Perishable and pharma shipments approach their temperature window.
• 04A customer threatens penalty clauses for missed SLAs.

What's assessed

• Manual-fallback and continuity procedures
• Third-party and carrier coordination
• Prioritisation of time- and temperature-critical freight
• Customer-SLA and penalty communication

Exercise objectives

• Activate manual operations for the highest-priority flows within 60 minutes of losing TMS and WMS.
• Prioritise time- and temperature-critical freight on criteria you can defend to every other customer.
• Keep carriers, partners and customers coherently informed through one channel discipline.
• Decide restore-versus-rebuild with SLA penalties quantified next to the security risk.

Roles at the table

• ●Crisis team lead · Synchronises operations, IT and customer management; owns the priority list everyone will hate.
• ●IT / SOC · Assesses TMS/WMS damage, vendor-access risk and the realistic recovery curve.
• ●Warehouse & transport operations · Runs paper picking and yard management; knows what ten percent capacity really moves.
• ●Communications / customer management · Carrier updates, customer calls and SLA conversations: before rumours do the routing.
• ●Legal · Penalty clauses, force-majeure questions, liability toward shippers and consignees.
• ●Executive management · Approves the priority rules and carries the cost of saying no to big accounts.

Discussion prompts

• 01Paper picking moves ten percent of normal volume. Which ten percent, and who explains it to the other ninety?
• 02Pharma shipments reach their temperature limit in four hours. Reroute to a competitor, or gamble on restoration?
• 03A carrier asks in writing whether reconnecting to your systems is safe. What do you sign, today?
• 04Do SLA penalties belong on the restoration priority list, and do you admit that to the customers who are not first?
• 05Your WMS vendor's remote access may be the entry point. Do you cut vendor access, and with it, their help?
• 06If recovery takes three days, which customers are gone for good, and does anyone at the table know their names?

Suggested timeline

• 00:00–00:25TMS/WMS lock-up: yard freeze, first triage, crisis declared
• 00:25–01:10Manual fallback: paper processes for priority freight
• 01:10–02:00Partner coordination: carriers, customers, vendor-access decision
• 02:00–02:40Restore vs. rebuild; SLA and penalty communication
• 02:40–03:00Hot wash: continuity gaps and single points of failure