Cyber incidents in Logistics jumped 61% in 2025.
A 61% year-on-year rise in logistics cyber incidents. Depending on the asset, Australian transport operators now answer to the SOCI Act, the aviation and maritime transport security Acts (which treat cyber security incidents as unlawful interference since March 2026), IMO expectations for cyber risk in ships' safety management systems, and the Cyber Security Act. The regulatory stack is dense and the threat is climbing.
Why Transport & Logistics is in the crosshairs
Five shifts shaping the Transport & Logistics threat environment — what attackers are now doing, and how the regulatory requirements are becoming more specific.
Attackers have shifted from individual companies to shared transportation networks
Everstream Analytics' framing captures the strategic shift: hackers are going after shared transportation networks, where a single breach can ripple across thousands of businesses. When DP World Australia detected unauthorised access in November 2023, it disconnected its network from the internet, halting land-side operations at Sydney, Melbourne, Brisbane and Fremantle for three days and leaving a backlog of some 30,000 containers. In July 2023, LockBit ransomware stopped container handling at the Port of Nagoya, Japan's busiest port, for about two days. The cascade is the attack.
The regulatory stack is SOCI plus ATSA plus MTOFSA plus IMO — at once
Depending on the asset, Australian transport entities face obligations under the SOCI Act (the CIRMP applies to critical freight infrastructure and freight services assets; ports, public transport and aviation assets carry incident reporting and other obligations), the aviation and maritime transport security Acts as amended by the Transport Security Amendment Act 2025, the Cyber Security Act 2024, the Privacy Act and, for ships under the ISM Code, IMO Resolution MSC.428(98). The same corporate network often sits under several of these at once.
Nation-state activity now includes physical surveillance via compromised IoT
The May 2025 joint advisory AA25-141A, co-sealed by ASD's ACSC, describes Russian GRU unit 26165 targeting Western logistics and technology companies involved in delivering aid to Ukraine, across air, sea and rail. The authoring agencies had a sample of more than 10,000 IP cameras targeted in a related campaign, and say the actors likely used access to cameras near border crossings, military installations and rail stations to track shipments. Transport compromise now reaches into the physical domain.
Legacy IT and OT converge uniquely here
Ships and port infrastructure run for decades. Terminal operating systems, rail signalling originally designed for isolated networks, and fleet telematics now share connectivity with corporate IT. The entry points are rarely sophisticated: at KNP Logistics, a single guessed employee password is thought to have been enough.
CIRMP requirements are becoming more specific
Data storage systems holding business critical data were brought within CIRMP scope on 4 April 2025. The Enhanced CIRMP Rules, in force since 10 June 2026, apply to nine asset classes including critical freight infrastructure and critical freight services: an uplifted cyber framework (Essential Eight ML2 or an equivalent), foreign ownership, control or influence (FOCI) requirements, and new credential-compromise (s 8B) and lateral-movement (s 8C) requirements with network segregation of critical systems as the benchmark, phasing in over 24 months (to June 2028).
What experts are saying
Executives and network defenders at logistics entities and technology companies should recognize the elevated threat of unit 26165 targeting, increase monitoring and threat hunting for known TTPs and indicators of compromise (IOCs), and posture network defenses with a presumption of targeting.
In 2025 alone, cyber incidents tied to logistics jumped 61%, climbing from 132 cases to 213. Hackers are moving away from hitting individual companies and instead going after shared transportation networks, where a single breach can ripple across thousands of businesses.
Transport Security Amendment Act and Enhanced CIRMP Rules now in force
Since 27 March 2026, the Transport Security Amendment (Security of Australia's Transport Sector) Act 2025 treats cyber security incidents as unlawful interference with aviation and maritime transport, with mandatory reporting to Home Affairs and ASD. Since 10 June 2026, the Enhanced CIRMP Rules have applied an uplifted cyber framework (ML2-equivalent) and lateral-movement requirements to critical freight infrastructure and critical freight services assets, phasing in over 24 months (to June 2028).
The SOCI Act covers 11 critical infrastructure sectors, including transport. Its transport asset classes are critical ports, freight infrastructure, freight services, public transport and aviation assets. Most carry the obligations to report cyber security incidents, to give information to the Register of Critical Infrastructure Assets (not required for critical aviation assets) and to notify third-party providers that store or process their business critical data. The Critical Infrastructure Risk Management Program (CIRMP) applies to critical freight infrastructure and critical freight services assets. For those entities, section 8 of the CIRMP Rules requires compliance with one of five specified cyber security frameworks — the Essential Eight, AESCSF, NIST CSF, ISO/IEC 27001 or the US DOE C2M2 — or an equivalent. The Enhanced CIRMP Rules 2026 lift that baseline to ML2-equivalent for freight assets, phasing in over 24 months (to June 2028). Aviation and maritime security sit under the Aviation Transport Security Act 2004 and the Maritime Transport and Offshore Facilities Security Act 2003; since 27 March 2026, the Transport Security Amendment (Security of Australia's Transport Sector) Act 2025 has treated cyber security incidents as unlawful interference under both. For ships under the ISM Code, IMO Resolution MSC.428(98) encourages administrations to ensure cyber risks are addressed in safety management systems. The Cyber Security Act 2024 applies in parallel.
Source: Transport Security Amendment (Security of Australia's Transport Sector) Act 2025
LegislationThe CIRMP applies to critical freight infrastructure and critical freight services assets. (Critical ports, public transport and aviation assets carry other SOCI obligations, such as cyber incident reporting, but not the CIRMP.) Section 8 of the CIRMP Rules requires compliance with a specified framework or an equivalent, plus minimising and mitigating material cyber risks.
For freight entities that chose the Essential Eight as their CIRMP framework. The CIRMP Rules set ML1 as the baseline, rising to ML2 for critical freight infrastructure and freight services assets under the Enhanced CIRMP Rules 2026 (phasing in to June 2028). NodeZero produces evidence for the technical strategies it can attack, such as patching and restricting administrative privileges.
Where NodeZero appliesFor freight entities that chose NIST CSF as their CIRMP framework. NodeZero provides partial coverage across the Identify, Protect and Detect functions. Govern, Respond and Recover are governance obligations.
Where NodeZero appliesFor freight entities that chose ISO/IEC 27001 as their CIRMP framework. NodeZero validates technical controls in the Technology theme. Organisational, People and Physical themes require separate evidence.
Where NodeZero appliesAustralian Energy Sector Cyber Security Framework, one of the frameworks the CIRMP Rules name. Designed for the energy sector; NodeZero contributes evidence on the IT side and does not test OT/SCADA environments.
Where NodeZero applies
One of the CIRMP-named frameworks, and a certification many transport and logistics-tech operators hold for customer assurance.
Where NodeZero applies
One of the CIRMP section 8 frameworks for freight entities; ML2-equivalent uplift for critical freight assets phasing in to June 2028.
Where NodeZero applies
Mandatory 72-hour ransomware payment reporting for businesses over $3M turnover, and for SOCI Part 2B responsible entities regardless of turnover.
Where NodeZero applies
Transport entities hold passenger data, parcel recipient data, fleet telematics driver data, and customer PII subject to APP 11 and the NDB scheme.
Where NodeZero applies
Often requested of logistics technology vendors (TMS, WMS, port community systems, freight platforms) selling to enterprise and SOCI-regulated customers.
Where NodeZero appliesA cascade of new obligations
Multiple new regulatory requirements are hitting simultaneously — each increasing the compliance burden and the consequences of failure.
SOCI CIRMP Rules — 2025 Measures No. 1 Rules
4 Apr 2025From 4 April 2025, a data storage system holding business critical data for a CIRMP asset is taken to be part of that asset for the CIRMP. Responsible entities must, as far as reasonably practicable, minimise or eliminate material risks and mitigate their relevant impact. Failing to adopt, maintain or comply with a CIRMP carries a civil penalty of 200 penalty units per contravention (SOCI Act ss 30AC–30AD; a 5x multiplier applies to bodies corporate).
Source: Federal Register of Legislation — LIN 25/011Transport Security Amendment (Security of Australia's Transport Sector) Act 2025
27 Mar 2026Royal Assent 27 March 2025; the main amendments commenced 27 March 2026. Amends ATSA and MTOFSA so that a cyber security incident with a relevant or significant impact is unlawful interference with aviation or maritime transport, and adds "operational interference", moving both regimes toward an all-hazards approach.
Source: Federal Register of Legislation — Act No. 22, 2025Cyber incident reporting for aviation and maritime
27 Mar 2026Critical aviation assets are not subject to the SOCI CIRMP or the Register. Under the amended ATSA and MTOFSA, industry participants must now report cyber security incidents to Home Affairs and ASD; for airport operators, within 12 hours for a significant impact on availability and 72 hours for a relevant impact.
Source: Transport Security Amendment Act 2025 — Schedule 1Cyber Security Act 2024 — ransomware payment reporting
30 May 2025Businesses with turnover above $3M, and SOCI Part 2B responsible entities regardless of turnover, must report a ransomware or cyber extortion payment to ASD within 72 hours. This sits alongside SOCI cyber incident notification (12 or 72 hours): a ransomware event at a SOCI-regulated port or freight operator can trigger both, if a payment is made.
Source: Cyber Security Act 2024Enhanced CIRMP Rules 2026
In force June 2026LIN 26/075 applies enhanced requirements to nine asset classes, including critical freight infrastructure and critical freight services assets: an uplifted cyber framework (Essential Eight ML2, C2M2 MIL-2, AESCSF SP-2, ISO/IEC 27001:2023, NIST CSF 2.0 or an equivalent), FOCI requirements, and new credential-compromise (s 8B) and lateral-movement (s 8C) requirements, phasing in over 24 months (to June 2028).
Source: Federal Register of Legislation — LIN 26/075NodeZero produces continuous testing evidence for part of the CIRMP cyber hazard obligations.
CIRMP obligations extend well beyond cyber testing — they cover governance, supply chain, personnel, physical, and business continuity. NodeZero produces testing evidence for part of the cyber and information security hazard obligations under Section 8. Drochaid's SOCI/CIRMP coverage kit, and kits for each framework section 8(4) names, show where that evidence applies.
Find your organisation
See how the changes affect you specifically
Ports & maritime
The 20 ports named as critical ports under the SOCI Act, shipping lines, port service providers, and offshore facilities. Regulated under the SOCI Act (asset registration and incident reporting), MTOFSA (cyber security incidents are now unlawful interference) and, for ships under the ISM Code, IMO MSC.428(98).
View details →Aviation, rail & freight infrastructure
Critical aviation assets (under the Aviation Transport Security Act, which now treats cyber security incidents as unlawful interference), rail freight operators, critical freight infrastructure, and logistics technology platforms.
View details →Road freight & 3PL
National carriers and the mid-tier 3PL ecosystem. Some are SOCI-regulated critical freight services assets; many sit above the Cyber Security Act's $3M turnover threshold and in their customers' third-party risk registers.
View details →Why security teams trust NodeZero
References
Everything cited on this page — regulator reports, incident coverage, and official framework documentation.
See your CIRMP and Transport Security Amendment Act 2025 cyber posture before an attacker does
See what an attacker could reach, and where NodeZero produces evidence for your CIRMP cyber obligations