On October 28, 2026, the WhiteArmor ransomware group added Echo Global Logistics, a Chicago-based freight broker and third-party logistics provider, to its leak site. The group is demanding $10 million in Bitcoin. It says it holds more than 2 million claims records, over 153,000 freight loads, and details on 3,890 employees, 2,418 customers and 9,122 carriers. Echo has not confirmed an incident or commented publicly, and no regulator filing or breach notification has appeared. Ransomware trackers and a law firm investigation notice have reported the listing, but nobody has independently verified the stolen data. For now this is a claim, not a confirmed breach.
What Happened
WhiteArmor posted its claim on October 28. Threat tracker DeXpose and security news site CyberNetSec.io have published the group's statement in full. It describes Echo accurately as a "technology-enabled third-party logistics provider" offering truckload, LTL, warehousing and cross-border shipping, and ends: "We suggest you pay a small ransom demand of $10,000,000 in BTC and move on with your lives." The group says it will email ransom instructions to the company and has posted data samples.
Class Action U, a legal information site, reports that a law firm published an investigation notice on the same day. The site describes WhiteArmor as a new group whose claims are unverified.
CyberNetSec.io reports that this is one of a series of WhiteArmor attacks on logistics firms, naming Ryder and J.B. Hunt as earlier targets. That suggests the group is focusing on transportation and supply chain companies. Only that outlet makes the link in the reporting reviewed here, and neither Ryder nor J.B. Hunt is quoted confirming an attack. Treat the "campaign" framing as reported, not established.
Trackers do not all describe the victim the same way. Breach House, which collects leak site listings, records the victim as "Echo.com," based in Germany and working in retail and e-commerce. That doesn't match the group's own statement, which clearly describes the US freight broker at echo.com. It looks like an automated classification error, not a different victim. Breach House marks the leak status as "leaked" (last checked October 29) and records the incident as not yet disclosed by the victim.
Separately, CyberSecureToday published a forensic write-up on October 10 about an SEC Form 8-K filed by an unnamed international container carrier. Nothing in that report ties it to Echo or WhiteArmor. It is a separate incident and shouldn't be read as an Echo disclosure. Echo has been privately held since 2021, so an SEC filing about this incident isn't expected.
What Was Taken
WhiteArmor lists the following, according to its statement as published by DeXpose and CyberNetSec.io:
- 2.06 million claims records
- 153,727 freight loads
- 261,440 quotes, which the group values at $705 million in "buy volume"
- 136,273 tenderings and 59,607 tracking records
- 3,890 employee identity mappings with email addresses
- Records on 2,418 customers and 9,122 carriers
- Warehouse location data
None of these figures has been verified. The employee number is worth a closer look. Public company profiles put Echo's workforce at about 2,600 (Airframe) or between 1,000 and 2,000 (a LinkedIn company summary). The group's figure of 3,890 is higher than both. That could mean the data includes former staff, contractors or duplicate entries, or that the number is inflated. Ransomware groups often pad their counts.
Class Action U points out that claims records in freight usually relate to cargo loss or damage. They can identify the people and businesses who filed them, along with names, addresses, contact details and loss amounts. WhiteArmor hasn't published a list of personal data categories, and no sample has been publicly checked.
For carriers and shippers, the bigger risk is probably commercial and operational rather than personal. Quote and tender data shows pricing and lane strategy. Carrier records and tracking data are the raw material for double-brokering and freight fraud. Warehouse location data could help cargo thieves.
Why It Matters
Freight brokers sit in the middle of thousands of business relationships. If WhiteArmor's numbers are accurate, the data covers more than 9,000 carriers and 2,400 shipper customers. Many of them could now be targets of convincing phishing that uses real load numbers, rates and contacts. Freight fraud already costs the industry heavily, and stolen broker data makes impersonation much easier.
If the reported attacks on Ryder and J.B. Hunt are confirmed, they would show a new group deliberately going after the logistics sector, where downtime is costly and the pressure to pay is high. The group's language ("move on with your lives") and the round $10 million demand are typical of data-theft extortion. Whether WhiteArmor also encrypted Echo's systems is unknown. CyberNetSec.io describes the attack as double extortion, but no source reports operational disruption at Echo.
Airframe, a vendor research site, noted in September 2026 that Echo's public materials did not clearly document SOC 2 or ISO 27001 certification. That isn't evidence of weak security, since many firms share these reports privately with customers. But customers doing vendor reviews should now ask for that evidence directly.
The Attack Technique
How WhiteArmor got in hasn't been confirmed. CyberNetSec.io reports that security firms Hudson Rock and ParanoidLab found many Echo employee credentials for sale in underground markets, stolen by infostealer malware. Breach House's dark web index similarly lists 11,503 echo.com entries in infostealer logs and 26,722 in older breach datasets. Neither finding proves those credentials were used in this attack. But buying access from infostealer operators is one of the most common ways ransomware groups get in, and a stockpile of exposed logins makes it a likely explanation.
CyberNetSec.io also links the activity to the MITRE ATT&CK technique for exfiltrating data to cloud storage (T1537). That is an analyst's inference, not a forensic finding.
CISA's October 8 advisory (AA26-281A) covers a different threat: Chinese government-linked actors working with Integrity Technology Group. There's no link between that activity and WhiteArmor. Its defensive guidance still applies here, though: password spraying, credential theft and abuse of VPN software are the same entry points that infostealer-fed ransomware groups use. CISA's priorities are multifactor authentication on every service, disabling unused remote access and file-sharing services, and prompt patching.
What Organizations Should Do
- Shippers and carriers that work with Echo: treat any unexpected request to change payment details, banking information or load instructions as suspicious until you've confirmed it through a known contact. Expect phishing that quotes real load numbers and rates.
- Check for infostealer exposure: watch infostealer logs and credential markets for your domain. Reset and revoke sessions for any exposed account, including session cookies and tokens, not just passwords.
- Require phishing-resistant MFA on VPN, remote access, email and cloud admin portals, as CISA recommends. Infostealers capture passwords and often session tokens too, so password-only and SMS-based logins won't stop a buyer of stolen access.
- Lock down bulk data access: alert on large exports from TMS, claims and quoting systems, and on unusual transfers to cloud storage. Limit which accounts can query whole datasets.
- Review third-party access: audit contractor and integration accounts with standing access to freight systems. Remove unused accounts and remote services.
- Logistics firms in general: update ransomware response plans with data-theft extortion in mind, including legal review of notification duties for claims data that may contain personal information.
Sources: WhiteArmor Ransomware Claims Breach of Echo Globa... - CyberNetSec.io | Chinese Government-linked Cyber Threat Actors Combine Automated and... | Whitearmor Ransomware Strikes Echo Global Logistics - DeXpose | Echo Global Logistics Data Breach Lawsuit - Class Action U | Echo Global Logistics Airframe | Echo.com — WHITEARMOR Ransomware Attack Breach House | SEC 8-K Freight Logistics Routing Breach Forensics CyberSecureToday | Matt Klusek