Technology

Major US shipping platform left customer data wide open to hackers

Published

2 months ago

January 31, 2026

Major US shipping platform left customer data wide open to hackers

NEWYou can now listen to Fox News articles!

Cargo theft is no longer just about stolen trucks and forged paperwork. Over the past year, security researchers have been warning that hackers are increasingly targeting the technology behind global shipping, quietly manipulating systems that move goods worth millions of dollars.

In some cases, organized crime groups use hacked logistics platforms to redirect shipments, allowing criminals to steal goods without ever setting foot in a warehouse. One recent case involving a critical U.S. shipping technology provider shows just how exposed parts of the supply chain have been, and for how long.

Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

A key shipping platform was left wide open

CRIME RINGS, HACKERS JOIN FORCES TO HIJACK TRUCKS NATIONWIDE, FUELING MAJOR HOLIDAY SHIPPING SECURITY FEARS

Digital shipping platforms now control how goods move worldwide, making cybersecurity failures a direct risk to the global supply chain. (John Keeble/Getty Images)

The company at the center of this incident is Bluspark Global, a New York-based firm whose Bluvoyix platform is used by hundreds of companies to manage and track freight moving around the world. While Bluspark isn’t a household name, its software supports a large slice of global shipping, including major retailers, grocery chains and manufacturers.

For months, Bluspark’s systems reportedly contained basic security flaws that effectively left its shipping platform exposed to anyone on the internet. According to the company, five vulnerabilities were eventually fixed, including the use of plaintext passwords and the ability to remotely access and interact with the Bluvoyix platform. These flaws could have given attackers access to decades of shipment records and customer data.

Bluspark says those issues are now resolved. But the timeline leading up to the fixes raises serious concerns about how long the platform was vulnerable and how difficult it was to alert the company in the first place.

How a researcher uncovered the flaws

Security researcher Eaton Zveare discovered the vulnerabilities in October while examining the website of a Bluspark customer. What started as a routine look at a contact form quickly escalated. By viewing the website’s source code, Zveare noticed that messages sent through the form passed through Bluspark’s servers using an application programming interface, or API.

From there, things unraveled fast. The API’s documentation was publicly accessible and included a built-in feature that allowed anyone to test commands. Despite claiming authentication was required, the API returned sensitive data without any login at all. Zveare was able to retrieve large amounts of user account information, including employee and customer usernames and passwords stored in plaintext.

Worse, the API allowed the creation of new administrator-level accounts without proper checks. That meant an attacker could grant themselves full access to Bluvoyix and view shipment data going back to 2007. Even security tokens designed to limit access could be bypassed entirely.

Why it took weeks to fix critical shipping security flaws

One of the most troubling parts of this story isn’t just the vulnerabilities themselves, but how hard it was to get them fixed. Zveare spent weeks trying to contact Bluspark after discovering the flaws, sending emails, voicemails, and even LinkedIn messages, without success.

With no clear vulnerability disclosure process in place, Zveare eventually turned to Maritime Hacking Village, which helps researchers notify companies in the shipping and maritime industries. When that failed, he contacted the press as a last resort.

Only after that did the company respond, through its legal counsel. Bluspark later confirmed it had patched the flaws and said it plans to introduce a formal vulnerability disclosure program. The company has not said whether it found evidence that attackers exploited the bugs to manipulate shipments, stating only that there was no indication of customer impact. It also declined to share details about its security practices or any third-party audits.

10 ways you can stay safe when cyberattacks hit supply chains

Hackers can break into a shipping or logistics platform without you ever realizing your data was involved. These steps help you reduce risk when attacks like this happen.

1) Watch for delivery-related scams and fake shipping notices

After supply chain breaches, criminals often send phishing emails or texts pretending to be shipping companies, retailers, or delivery services. If a message pressures you to click a link or “confirm” shipment details, slow down. Go directly to the retailer’s website instead of trusting the message.

2) Use a password manager to protect your accounts

If attackers gain access to customer databases, they often try the same login details on shopping, email, and banking accounts. A password manager ensures every account has a unique password, so one breach doesn’t give attackers the keys to everything else.

Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

3) Reduce your exposed personal data online

Security researchers found exposed APIs that allowed access to sensitive shipping data without proper authentication. (Portra/Getty Images)

Criminals often combine data from one breach with information scraped from data broker sites. Personal data removal services can help reduce how much of your information is publicly available, making it harder for criminals to target you with convincing scams.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

4) Run strong antivirus software on your devices

Strong antivirus software can block malicious links, fake shipping pages, and malware-laced attachments that often follow high-profile breaches. Keeping real-time protection enabled adds an important layer when criminals try to exploit confusion.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

HUGE DATA LEAK EXPOSES 14 MILLION CUSTOMER SHIPPING RECORDS

5) Enable two-factor authentication wherever possible

Two-factor authentication (2FA) makes it much harder for attackers to take over accounts, even if they have your password. Prioritize email, shopping accounts, cloud storage and any service that stores payment or delivery information.

6) Review your account activity and delivery history

Check your online shopping accounts for unfamiliar orders, address changes, or saved payment methods you don’t recognize. Catching changes early can prevent fraud from escalating.

7) Consider identity theft protection

Identity theft protection services can alert you to suspicious credit activity and help you recover if attackers access your name, address or other personal details. Identity Theft companies can monitor personal information like your Social Security Number (SSN), phone number, and email address and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com

8) Place a free credit freeze to stop new fraud

If your name, email, or address was exposed, consider placing a credit freeze with the major credit bureaus. A freeze prevents criminals from opening new accounts in your name, even if they obtain additional personal data later. It’s free, easy to lift temporarily, and one of the most effective steps you can take after a breach. To learn more about how to do this, go to Cyberguy.com and search “How to freeze your credit.”

9) Lock down your shipping and retailer accounts

Review the security settings on major shopping and delivery accounts, including retailers, grocery services and shipping providers. Pay close attention to saved delivery addresses, default shipping locations and linked payment methods. Attackers sometimes add their own address quietly and wait before making a move.

10) Businesses should review third-party logistics access

If you run a business that relies on shipping or logistics platforms, incidents like this are a reminder to review vendor access controls. Limit administrative permissions, rotate API keys regularly, and confirm vendors have a clear vulnerability disclosure process. Supply chain security depends on more than just your own systems.

Hackers increasingly target logistics technology, manipulating systems to redirect shipments without physical theft. (Thomas Trutschel/Photothek via Getty Images)

Kurt’s key takeaway

Shipping platforms sit at the intersection of physical goods and digital systems, making them attractive targets for cybercriminals. When basic protections like authentication and password encryption are missing, the consequences can spill into the real world, from stolen cargo to supply chain disruption. The incident also highlights how many companies still lack clear, public ways for researchers to report vulnerabilities responsibly.

Do you think companies that quietly power global supply chains are doing enough to protect themselves from cyber threats? Let us know by writing to us at Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

Related Topics:Featured Hackers Security smart and safe tech

Click to comment

Technology

Now the FAA says gamers are the answer to its air traffic controller shortage

Published

9 hours ago

April 10, 2026

Press Room

Now the FAA says gamers are the answer to its air traffic controller shortage

The Federal Aviation Administration (FAA) has struggled for years to have enough air traffic controllers to address shortages, with the US Government Accountability Office (GAO) saying in January that the number of people in the job in the US has declined by around 6 percent “in the last decade.” Now the Trump administration is rolling out a recruiting campaign targeting gamers ahead of the opening of the annual air traffic control hiring window on April 17th.

Even with the campaign, getting qualified individuals through training and into the role may still be a challenge: according to the Department of Transportation’s Office of Inspector General (OIG), the FAA is facing “considerable challenges with training, including a shortage of qualified instructors, training capacity limitations, an outdated curriculum, and high training failure rates.”

An FAA video full of clips of things like Madden NFL, Fortnite, League of Legends esports, and the Xbox One stinger from commercials promises an average salary of $155,000 per year after three years and says that “you’ve been training for this.”

In a press release, the FAA says that air traffic controllers said in exit interviews that gaming was an influence on “their ability to think quickly, stay focused, and manage complexity.” The FAA’s website about the application process encourages applicants to “level up” their career. However, the Trump administration isn’t the first to target gamers for the role; according to The New York Times, the Biden administration launched a “Level Up” recruiting push in 2021, encouraging gamers as well as women and members of minority groups to become air traffic controllers.

Getting more air traffic controllers has been a focus for Sean Duffy, President Trump’s secretary of transportation, and he announced a plan to “supercharge” hiring shortly after he was sworn in for the job last year. That campaign closed in March 2025 and “attracted more than 10,000 applications,” resulting in about 600 trainees entering the Controller Training Academy, the OIG says. And the GAO says that some attrition during the air traffic controller hiring process “may be preventable,” noting that the hiring process can be “difficult to navigate” and that applicants may have already accepted other jobs by the time they get an employment offer.

The National Air Traffic Controllers Association (NATCA), the union representing air traffic controllers, “welcomes innovative approaches to expanding the candidate pool,” including “outreach to individuals with high-level aptitude skills such as gamers,” according to a statement from NATCA president Nick Daniels.

Technology

Google search led to a costly scam call

Published

10 hours ago

April 10, 2026

Press Room

NEWYou can now listen to Fox News articles!

You book a flight. You reschedule. Then you try to handle travel insurance quickly so you can move on with your day. That’s exactly what happened to Rosette. She was trying to reach Allianz, a large travel insurance company that many airlines direct customers to after booking.

Within seconds, she was talking to a scammer who sounded completely legitimate. Here’s how she described it:

“I Googled Allianz and clicked on the phone number. It was answered within 1 second. . . . It was NOT Allianz I was speaking to. They have my Citicard number and my date of birth. . . . When I questioned it, he said ‘I will not charge your card’ and disconnected.”
— Rosette

That realization hits hard. Suddenly, you start replaying everything in your head. Maybe you thought you knew what to look for. Still, the frustration sets in fast. Here’s the truth: This happens every day to smart, careful people. And the scams keep getting more convincing.

TECH GIANTS UNITE TO FIGHT ONLINE SCAMS

Fake phone numbers in search results are fueling a surge in travel insurance scams targeting unsuspecting callers. (Yuliya Taba/Getty Images)

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com — trusted by millions who watch CyberGuy on TV daily.
Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

How this fake travel insurance phone scam works

This is known as a search result scam, and it is one of the fastest-growing fraud tactics right now.

Here’s the typical playbook:

You search for a company like a travel insurance provider, airline or your bank
A fake phone number appears at the top of the results or in an ad
You call and reach a professional-sounding call center
The scammer acts helpful, fast and confident
They ask for payment details or personal information

In Rosette’s case, there were several clear signs once you step back:

The call was answered instantly
The pricing felt unusually high
The email came from a fake domain
The agent pushed for authorization

Once she questioned it, the scammer disconnected. That’s classic behavior.

Why this phone scam is so easy to fall for

This is not sloppy fraud. It’s polished, fast and designed to catch you when you are distracted. Here’s why it works so well:

1) You trust search results

Most people assume search results are safe. Scammers exploit that trust with fake listings and ads.

2) Timing creates pressure

You are often dealing with travel changes, delays or deadlines. That lowers your guard.

3) They sound legitimate

These are not obvious scammers. Many operate scripted call centers with trained agents.

4) They move fast

Answering within seconds creates the illusion that you reached the right company.

SSA IMPERSONATION SCAMS ARE GETTING MORE PERSONAL

A quick Google search led one woman to a convincing scam call center posing as a legitimate insurer. (golibo/Getty Images)

What information did the scammer actually get?

In Rosette’s situation, the scammer obtained:

Credit card number
Date of birth

That combination matters. Even without an immediate charge, scammers often:

Test small transactions later
Attempt identity-based fraud
Sell your data to other criminals

This is why you should treat it as a compromised card situation, even if nothing has been charged yet.

What this means to you

This type of scam does not rely on hacking your device. It relies on tricking you into calling the wrong number. That means anyone can fall for it.

You could be booking travel, fixing a billing issue or calling tech support. One wrong click puts you in direct contact with a scammer who already sounds like the real company.

The danger is not just the initial call. It is what happens next if your information is reused or shared.

How to protect yourself from fake phone scams

Here’s how to protect yourself from this exact scenario moving forward:

1) Never trust phone numbers from search results

Always go directly to the company’s official website and find the contact page there.

2) Use the number on your card or confirmation email

These are far more reliable than anything you find through a quick search.

3) Watch for instant answers and pressure

Real companies rarely answer instantly and push for immediate payment details.

WHY THAT $4 CHARGE ON YOUR STATEMENT COULD BE FRAUD

A traveler searching for Allianz support reached a scammer instead, exposing personal and financial information in seconds. (fizkes/Getty Images)

4) Check the email domain carefully

If it does not match the official company domain, it is a red flag.

5) Replace compromised cards immediately

Do not wait for fraud to appear. Request a new card number right away.

6) Turn on real-time alerts

Enable transaction alerts so you can catch suspicious activity early.

7) Freeze your credit if personal data is exposed

This adds a strong layer of protection against identity theft.

8) Consider identity theft protection

If your personal information was exposed, identity theft protection can monitor your identity, alert you to suspicious activity and help you respond quickly if something goes wrong. See my tips and best picks on Best Identity Theft Protection at Cyberguy.com.

9) Remove your personal data from public databases

Data broker sites collect and sell your personal details. Removing your information reduces the chances scammers can find and target you again. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

What Rosette did right

It’s important to call this, out because it matters.

She questioned the pricing
She challenged the caller
She stopped before a charge went through
She contacted her bank quickly

Those steps significantly reduced the damage. This could have gone much further.

Kurt’s key takeaways

Scams like this are not about being careless. They are about being human. You were trying to solve a problem quickly. The scammer was ready for that exact moment. The biggest takeaway is simple: Slow down when money or personal information is involved. Even a few extra seconds to verify a phone number can make all the difference. And if something feels off, trust that instinct.

If you needed to call your bank or airline right now, would you trust the first number you see online? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com — trusted by millions who watch CyberGuy on TV daily.
Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Technology

Microsoft starts removing Copilot buttons from Windows 11 apps

Published

21 hours ago

April 10, 2026

Press Room

Microsoft starts removing Copilot buttons from Windows 11 apps

Microsoft is starting to remove “unnecessary” Copilot buttons from its Windows 11 apps. In the latest version of the Notepad app for Windows Insiders, Microsoft has removed the Copilot button in favor of a “writing tools” menu. The Copilot button in the Snipping Tool app also no longer appears when you select an area to capture.

The change is part of “reducing unnecessary Copilot entry points, starting with apps like Snipping Tool, Photos, Widgets and Notepad,” that Microsoft promised to complete as part of its broader plan to fix Windows 11. While Copilot buttons are being removed, it looks like the underlying AI features are here to stay, though.

The Copilot button has been removed from Notepad, but the writing tools replacement still uses AI-powered features and looks like the identical menu of options that existed before. I still think these features are largely unnecessary in what’s supposed to be a lightweight text app, but removing the superfluous Copilot branding is a good first step.