$3.3 Million in Cigarettes, Two Pickups, One Fake Carrier — the CJ Logistics Colonial Heights Case

Sometime in March 2026, a tractor-trailer pulled up to the CJ Logistics America distribution facility in Colonial Heights, Virginia, just south of Richmond. The truck carried the name and registration markings of Preston Deliveries, LLC — a real, legitimate motor carrier. The driver's pickup paperwork matched a real outbound load: cigarettes, destined for Tennessee and Florida. The facility loaded the trailer and the truck drove off.

Weeks later — same month, same facility — another truck wearing the same carrier's identity arrived for a second cigarette load. It, too, was loaded and released. Combined value of the two pickups, according to the Manhattan District Attorney's office: more than $3.3 million. Neither truck had anything to do with Preston Deliveries. The cigarettes never went to Tennessee or Florida. They went north, through Manhattan, into the Bronx.

In June 2026, Manhattan DA Alvin Bragg announced an indictment charging eight men with running this operation — and it turned out the Colonial Heights cigarettes were only the biggest line item in a six-theft, nearly $5 million spree across Virginia, Pennsylvania, and New Jersey. The case is one of the cleanest public illustrations yet of how modern cargo theft actually works: as a supply chain of its own, with a cyber division, a transport division, and a resale division.

The known facts

Two details separate this case from the average fictitious-pickup story. First, the stolen freight was actually recovered — investigators executed a search warrant in the Bronx and found the cigarettes before they finished dispersing into the black market, which is rare enough to be newsworthy on its own. Second, and more important for anyone who operates a dock: the same facility released freight to the same fake carrier twice, roughly weeks apart.

A theft ring organized like a logistics company

According to prosecutors, the eight defendants — led operationally by Murodullo Khasanov, with drivers including Dilshod Nabiev and Nizom Ismoilov — did not hack anyone themselves. They allegedly bought or traded for their targeting data from separate criminal syndicates that run phishing campaigns against freight brokers and shippers. Those phishing crews harvest exactly the fields that make a pickup packet look real: load numbers, pickup windows, commodity and quantity, the assigned carrier's name and DOT/MC numbers.

With that data in hand, the crew's playbook was almost mechanical:

• Lease clean trucks. Rented or leased tractors have no criminal history and nothing to flag at a gate.
• Dress them as the assigned carrier. Print and affix the legitimate carrier's name and registration numbers. From the guard shack, the truck is Preston Deliveries.
• Send a driver with matching paperwork. Because the shipment data came from inside the broker's or shipper's communications, every field the warehouse could check — load number, PO, carrier, timing — matched.
• Drive the freight to New York. The goods moved through Manhattan into Bronx storage, staged for cash sale into the black market.

The same template produced the other five thefts in the indictment: $295,000 of beef, $165,000 of lamb, $432,000 of cheese, $266,000 of copper — picked up from logistics facilities in Pennsylvania and New Jersey by trucks that appeared, on paper and on paint, to be the carriers those loads were assigned to.

Why the dock said yes — twice

It is tempting to read this case as a story about a careless warehouse. It is the opposite: it is a story about a warehouse doing every standard check and the checks not being connected to anything an attacker can't copy.

Walk through what the dock could verify in March 2026:

• Carrier name on the truck: matched the assignment. It was a sticker on a leased tractor.
• DOT / MC numbers: matched, and looked up clean — because they belonged to the real, innocent carrier.
• Load and PO numbers: matched, because they were phished from the people who created them.
• Pickup window: matched, for the same reason.
• Driver's license: a real license belonging to a real person standing in front of the clerk — just a person with no legitimate connection to the load.

Every check the dock ran verified the load or the carrier. Not one check verified the person — because nothing in the workflow tied this specific pickup to a specific human being the broker had actually dispatched.

And that explains the second truck, which is the most instructive part of the case. When the first theft succeeded, nothing in the release workflow recorded anything that would make a second attempt harder. The paperwork channel was still compromised. The carrier identity was still copyable. The next load of cigarettes was still sitting on the schedule. The crew simply ran the same play against the same facility, and the facility — with no memory of the first truck being wrong, because it didn't yet know — said yes again.

Where the scheme would have broken

Freight fraud of this class survives every document check by construction: the documents are generated from stolen-but-genuine data. The only element the crew cannot phish, print, or lease is the face of the driver the broker actually assigned.

If the release workflow had required the dock to compare the person at the window against the driver identity created inside the broker's system at dispatch — not against anything the driver carried in — the first truck fails at the guard shack. The paperwork matches, the truck's paint matches, and none of it matters, because the man standing at the dock is not the man on the dispatch record.

What this case adds to the pattern

Readers of our Noble Oak bourbon case study will recognize the skeleton: phished shipment data, forged or borrowed carrier identity, an impostor at the dock, freight into the New York resale network. The Colonial Heights case extends that pattern in three ways worth noting.

1. Specialization is now the norm. The people who stole the data never touched a truck; the people who drove the trucks never sent a phishing email. Prosecutors describe the theft crew as customers of the phishing syndicates. Each side does one thing well, which lowers the skill bar for both.

2. Carrier impersonation beats carrier vetting. Preston Deliveries was, by every public record, a legitimate carrier in good standing. Vetting the carrier harder would have changed nothing — the carrier was innocent. The entity that needed verifying was the individual human at the dock, and no amount of FMCSA diligence reaches him.

3. Success gets replayed. A workflow that can be fooled once can be fooled on a schedule. The two Colonial Heights pickups, weeks apart, are the clearest recent proof that these crews treat a working exploit like a route — they run it until something in the workflow changes.

The recovery in the Bronx was good police work, and the industry should not count on it. As we covered in our piece on where stolen freight goes, recovery is the exception; cigarettes in particular liquidate fast, carton by carton, into cash channels. The lesson of this case is not that stolen freight comes back. It is that the release decision at the dock is the last moment the freight is still yours.

The takeaway

Two trucks, one month, one facility, $3.3 million. Every document matched because the documents' source had been compromised; the truck matched because carrier identity is a decal; and the second theft worked because the first one left no trace in the release workflow. The defense that survives this class of attack is the one thing the crew could not manufacture: a live, dispatch-bound check of who is actually standing at the dock — with a workflow that remembers every release it has already made.

About TrailersSafe

TrailersSafe is a Delaware-based U.S. company focused on identity verification at freight pickup. Our warehouse verification page shows the assigned driver's face and redacted license, pulled from the dispatching system, at the moment a one-time QR code is scanned at the dock.

• Service area: all 50 U.S. states
• Languages: English and Simplified Chinese

If you would like a 15-minute walkthrough — including how both Colonial Heights pickups would have been blocked — visit trailerssafe.com.

Disclaimer: This article summarizes allegations in a June 2026 Manhattan District Attorney indictment and related public reporting on cargo thefts between October 2025 and April 2026, including two March 2026 cigarette thefts from a Colonial Heights, Virginia logistics facility. All defendants are presumed innocent unless and until proven guilty. Loss figures are prosecution estimates. TrailersSafe significantly reduces impersonation-based cargo theft risk but does not guarantee zero loss.