What Happened
Supply-Chain Crime · Hardware · Logistics · Source ReviewWIRED · 12 Aug 2026
Source review · what is solid, and what is not
The Ramming Is Unverified. The Paperwork Is Not.
WIRED says thieves attacked two security cars that were escorting AI hardware. One was rear-ended by a car that then drove off. The other was spun off the road. Both loads then vanished. Nobody was hurt, and nobody has been arrested. All of that comes from one consultant, who says the police told him. WIRED asked five law-enforcement agencies, and not one would confirm it. The same article also reports things that are fully on the record: a named officer, seizures announced in public, a quarterly data release, a federal bulletin. Those point somewhere else. What thieves are really taking is not the lorry. It is the haulage firm's identity, bought or hacked.
Two attacks nobody can confirm, and recoveries anyone can Both are in the same article. They are not the same kind of thing.
- 677thefts from the supply chain in the second quarter of 2026, down 26% on a year earlier
- $304.6mlost in that same quarter — 2.24 times the figure a year earlier
- $449,926average loss per theft. The figure people quote, $564,009, leaves out thefts with no value reported
- 5police forces asked about the two attacks. None would confirm them
First · rear-ended
A security car is hit from behind, and the other driver leaves
- The car that was hit was the security escort, not the lorry. Knocking it out leaves the load with nobody watching it.
- The AI hardware it was escorting never arrived.
- Nobody was hurt. No police force has confirmed that this happened at all, so there is nothing on the record about an arrest either.
- Pachuca says the load was collected using a carrier number that had recently been sold. That is not confirmed.
Second · spun off the road
A security car is spun out by a PIT manoeuvre
- A PIT manoeuvre spins a car by nudging its back corner. Police forces are trained to do it.
- This load never arrived either.
- Again nobody was hurt, and again no police force has confirmed it. Danny Ramon of Overhaul says police sources called it a “coordinated assault”. He was not there either.
- All three men who describe these attacks think the lorry drivers were in on it.
How firmly each part stands Confirmed, true but unchecked here, unconfirmed, guesswork, and one document that is not public.
| How firm | What | Who says so |
|---|---|---|
| Confirmed | More than $2.2m recovered in June across three incidents, including $550,000 of Celestica switches on their way to Meta | Sergeant Omar Morales of the California Highway Patrol, speaking for his force |
| Confirmed | $4m seized in southern California in May, including Deepcool AI cooling gear. One arrest — the only arrest anywhere in this story | Announced in public by southern Californian authorities |
| Confirmed | April to June 2026: 677 thefts, down 26%, while losses more than doubled to $304.6m | Verisk CargoNet, 6 Aug 2026. We fetched the release and worked every figure out again |
| Confirmed | 2025: the number of incidents barely moved, but confirmed thefts rose 18% to 2,646 | Verisk CargoNet, 22 Jan 2026, fetched the same way |
| Confirmed | Motus opened to suppliers in December 2025. The stage covering everyone else was planned for April to June 2026 | FMCSA's own notice in the Federal Register, 29 Apr 2026 |
| True, but not checked here | The FMCSA bulletin of 13 March 2026, and its exact wording | Land Line and CDLLife quote it word for word, and they match. fmcsa.dot.gov turned us away, so we never read the original |
| True, but not checked here | About $1m of data-centre equipment found in a stolen trailer near Chicago, on the same day as the June recovery | WIRED, which does not say which force found it |
| True, but not checked here | An escort company was attacked while guarding “high-value technology” | J.J. Coughlin, repeating what the firm told him. It backs up that an attack happened, not what was in the lorry |
| Unconfirmed | The two attacks themselves — both cars disabled on purpose, both loads gone | Gerardo Pachuca, a consultant and former Los Angeles detective, passing on what he says police told him. WIRED asked five forces and none confirmed it |
| Unconfirmed | Both loads were collected using recently sold carrier numbers | Pachuca, who would not say more because investigations are still open |
| Unconfirmed | A “coordinated assault” on a load of AI hardware, days after the first attack | Danny Ramon of Overhaul, also passing on what police sources told him |
| Guesswork | Much of the stolen hardware is being shipped abroad | Pachuca and others in the freight business, going on where parts show up when someone switches them on. They call it a suspicion. No authority has published anything |
| Guesswork | The lorry drivers were in on it | All three men assume it. Nobody has shown it. It is also why “violent” describes the method here rather than the result |
| Not public | 34,560 optical transceiver cables and 96 switch modules taken in April, on the road from Mississippi to Texas | A private investigators' notice sent round the freight trade, which WIRED saw. The document is not public |
Timeline
Everything in the story that has a date The two attacks are missing from this list because nobody ever gave a date for them.
- 2024Baseline year: 3,607 supply-chain crime events, 2,243 confirmed cargo thefts.
- 2025Events essentially flat at 3,594, but confirmed thefts rise 18% to 2,646. Losses about $725m.
- Dec 2025Motus Phase I opens, to supporting companies only.
- 22 Jan 2026CargoNet publishes its annual analysis — and forecasts that tighter licence enforcement will put more carriers up for sale, “creating new opportunities for criminal enterprises”.
- 13 Mar 2026FMCSA bulletin: a USDOT number “belongs to the same legal person forever and may not be sold, transferred, rented or leased”.
- Apr 202634,560 optical transceivers and 96 switch modules taken between Mississippi and Texas — known only from a private notice that is not public.
- 29 Apr 2026The Federal Register notice sets out Motus. Phase II, covering all regulated entities, is planned for the second quarter.
- May 2026$4m seized in Southern California, including Deepcool AI cooling equipment. One arrest — the only one anywhere in this story.
- Jun 2026California Highway Patrol recovers more than $2.2m across three incidents, including $550,000 of Celestica-built switches bound for Meta. About $1m more is found in a stolen trailer near Chicago the same day.
- Q2 2026677 supply-chain theft incidents, down 26% year on year, while losses more than double to $304.6m.
- 3 Jul 2026Fortune describes “fewer thefts, worth more”. It is a false description of 2025 and an accurate one of the quarter just ended.
- 6 Aug 2026CargoNet publishes the second-quarter analysis.
- 12 Aug 2026WIRED publishes, carrying the documented cases above and the two attacks below in a single article.
The Argument
What WIRED argues, and what its own reporting complicates The piece is built on escalation: theft has turned violent in the hunt for AI hardware.
The three men who describe the attacks agree on two things, and both make violent a harder word to use. Nobody was hurt. And all three think the lorry drivers were in on it. If they are right, the ramming was meant to shake off the escort, not to hurt anyone in it. It was aimed at the people watching, not at the people driving. That is still a step up, and the escort trade is treating it as one. Firms now tell their staff to call 911 at the first sign of trouble. One says its work used to peak before Christmas and now runs all year, with cooling parts, servers and chips as its biggest jobs. But if you have to decide what to do about this, the difference matters.
- 0of the five police forces asked could confirm any part of the two attacks
- 3people describe the attacks. None of them was there, and none names a shipper, a date or a police force
- 13,000loads one escort firm says it has guarded in four years without losing one
What Others Add
The thing being stolen is a registration Every case in the article that can be checked runs through the haulier's identity.
- 1Get hold of an identityHack a real firm's email, or simply buy its carrier number. Either way you now hold a licence with years of clean history behind it.
- 2Take a jobBid for freight posted online. Hundreds of thousands of one-lorry firms do exactly this every day, which is why nothing looks wrong.
- 3Pick up the loadShow paperwork faked to match the real firm. Any tracker on the load can be fed a false position or switched off.
- 4Never deliver itThe load is sold on. People in the freight trade suspect much of it leaves the country, going on where parts appear when they are switched on. That is a suspicion, not a finding.
CargoNet saw this route coming. In January 2026 it warned that tighter licence checks would push more haulage firms to sell up, and that this could “create new opportunities for criminal enterprises”. That is the route both attacks are said to have used. Regulators moved on 13 March 2026, and the bulletin is blunter than most summaries of it: a USDOT number “belongs to the same legal person forever and may not be sold, transferred, rented or leased”. A company can change hands and keep its number, because the company is the legal person holding it. A one-man firm cannot pass its number on at all, because nobody else can become that man. Trade one outside a proper company sale and FMCSA will switch the number off and cancel every registration attached to it. Motus, the new registration system, is often called an anti-fraud measure. FMCSA does not describe it that way. Its own notice calls Motus a modernisation that will “incorporate enhanced verification tools” — one clause out of four.
- 13 Mar2026 — the bulletin banning the sale, purchase or lease of a carrier number
- −23%thefts of this kind, April to June 2026 against a year earlier — the bought-identity route shrinking
- steadyemail break-ins, which CargoNet calls the main way into the quarter's most sophisticated thefts
Fewer thefts, worth far more — now Two periods, two directions. They do not contradict each other.
| Window | Incident measure | Change | Estimated losses |
|---|---|---|---|
| 2025, full year | 3,594 supply-chain crime events | −0.4% | ~$725m, +60% |
| 2025, full year | 2,646 confirmed cargo thefts | +18% | — |
| Q2 2026 | 677 supply-chain theft incidents | −26% | $304.6m, +124% |
| Q2 2026 | 378 events classified as theft | −23% | — |
Conclusion
What to take away Three things, and the last one is a caution about the rest.
That framing was early, not wrong
“Fewer thefts, worth more” was a false description of 2025, when confirmed thefts went up 18% — see the earlier article. It is a true description of April to June 2026. WIRED wrote after those figures came out, uses the phrase correctly, and says where it comes from.
$564,009 is not the typical theft
CargoNet's own release warns that this average “was heavily influenced by a small number of extreme, multimillion-dollar losses”, and that it counts only thefts where a value was reported. Spread across all 677, the average is $449,926.
The attacks are still only a claim
No police force has confirmed them. That does not make them false — open investigations are not public — but you should hold them more loosely than a seizure a named officer described on the record.