Feds charge driver in alleged $12M cargo theft scheme built on hijacked carrier identities

Federal prosecutors have uncovered an alleged cargo theft conspiracy involving at least 24 freight shipments and millions in stolen merchandise. Investigators say suspects took control of established trucking companies and used their identities to secure legitimate freight contracts. Drivers then collected shipments from distribution facilities, but the cargo never reached its intended destinations. Authorities estimate that thefts involving one defendant exceeded $12 million in retail value.

The U.S. Attorney’s Office for the District of Connecticut announced federal charges against Nursulton Khaydarov on October 21. Khaydarov, 33, is a citizen of Uzbekistan and lawful permanent resident of the United States. Prosecutors accuse him of participating in a conspiracy that targeted interstate shipments from California and other locations. He pleaded not guilty during an appearance in federal court in Bridgeport, Connecticut.

According to federal investigators, the operation began around September 2025 and involved multiple motor carriers. Participants purchased trucking businesses or otherwise assumed control of their existing operations. They obtained U.S. Department of Transportation numbers, motor carrier identification numbers, business email accounts and ownership identities. The group then impersonated previous owners to negotiate transportation agreements with freight brokers.

How the alleged carrier takeover scheme worked

The suspects relied on established business identities rather than creating entirely new trucking companies. Prosecutors contend that these arrangements allowed participants to exploit existing reputations and relationships within the freight industry. Brokers negotiated interstate transportation contracts with individuals posing as legitimate carrier representatives. After drivers collected the merchandise, the shipments disappeared before reaching their scheduled delivery locations.

window.googletag = window.googletag || {cmd: []};
googletag.cmd.push(function() {
var gptSlot = googletag.defineSlot(‘/21776187881/FW-Responsive-Main_Content-Slot1’, [[300, 100], [320, 50], [728, 90], [468, 60]], ‘div-gpt-ad-1709668545404-0’).defineSizeMapping(gptSizeMaps.banner1).addService(googletag.pubads());
googletag.pubads().enableSingleRequest();
googletag.pubads().collapseEmptyDivs();
googletag.enableServices();
setInterval(function() {
if (!document.hidden) { googletag.pubads().refresh([gptSlot]); }
}, 60000);
});

googletag.cmd.push(function() { googletag.display(‘div-gpt-ad-1709668545404-0’); });

The scheme resembles a growing problem involving the buying and selling of established trucking companies. Some operators acquire existing businesses to obtain operating histories, established credentials and relationships with freight brokers. Older authorities may pass routine vetting more easily because their federal records already show years of activity. FMCSA has warned against buying, selling or leasing operating authority outside legitimate corporate transactions.

For freight brokers, the challenge extends beyond confirming an active DOT number or valid insurance. Recent ownership changes, updated contact information and unfamiliar email domains can warrant additional verification. Insurance changes and inconsistencies between registration records also deserve closer examination. An established operating history means little if brokers cannot verify who actually controls the company.

The indictment describes additional steps participants allegedly took to conceal their activities. Prosecutors accuse the group of switching tractor license plates and using burner phones with encrypted messaging applications. Court records also describe efforts to defeat electronic shipment tracking systems. Investigators contend that participants provided false explanations about delayed or missing freight after completing pickups.

Federal investigators also documented ransom demands involving stolen shipments. According to the indictment, participants requested cryptocurrency or electronic transfers in exchange for returning merchandise. An FBI affidavit identifies approximately $121,000 in cryptocurrency that Khaydarov’s Coinbase account received across 33 transactions. Those payments occurred between November 2025 and May 2026, although investigators did not establish that every transfer represented ransom.

The stolen merchandise covered several categories of commercial freight. Prosecutors identified hard drives, stereo equipment, clothing, electronics and computer equipment among the missing products. Other shipments contained food items, nicotine products and additional consumer goods. Investigators attributed more than $12 million in estimated retail losses to thefts involving Khaydarov personally.

Multiple driver identities uncovered

Federal court documents also describe several fraudulent driver’s licenses connected to Khaydarov. Authorities identified five different names appearing on those documents. Each license displayed his photograph with altered facial features. Investigators also confirmed that he possessed a valid New Jersey commercial driver’s license.

One documented incident involved a pistachio shipment departing Terra Bella, California, for Laredo, Texas, on December 19, 2025. Investigators reported that the driver presented an Illinois license identifying him as Sayid Makhmudarov. State motor vehicle records showed no matching license, and photographs connected that document to Khaydarov. California’s pistachio industry has faced growing concerns over cargo theft, particularly during harvest season when high-value shipments enter transportation networks.

window.googletag = window.googletag || {cmd: []};
googletag.cmd.push(function() {
var gptSlot = googletag.defineSlot(‘/21776187881/fw-responsive-main_content-slot3’, [[728, 90], [468, 60], [320, 50], [300, 100]], ‘div-gpt-ad-1665767553440-0’).defineSizeMapping(gptSizeMaps.banner1).addService(googletag.pubads());
googletag.pubads().enableSingleRequest();
googletag.pubads().collapseEmptyDivs();
googletag.enableServices();
setInterval(function() {
if (!document.hidden) { googletag.pubads().refresh([gptSlot]); }
}, 60000);
});

googletag.cmd.push(function() { googletag.display(‘div-gpt-ad-1665767553440-0’); });

On May 18, police in Ontario, California, located a tractor-trailer associated with suspected cargo thefts. During a traffic stop, Khaydarov identified himself using his valid New Jersey driver’s license. Officers discovered suspected counterfeit identification and a nicotine product matching merchandise from an earlier theft. Police impounded the equipment, and FBI agents subsequently searched the tractor under a federal warrant.

Federal authorities arrested Khaydarov in Ontario, California, on June 1, 2026, following a criminal complaint. A grand jury in New Haven, Connecticut, returned an indictment on September 22. The indictment charges him with conspiracy, which carries a maximum prison sentence of five years. He has remained in custody since his arrest.

Federal investigation continues across multiple agencies

The FBI leads the investigation with assistance from several federal and local enforcement partners. Participating agencies include Homeland Security Investigations, IRS Criminal Investigation and the U.S. Department of Transportation’s Office of Inspector General. Police departments in Fullerton and Ontario, California, also contributed investigative resources. Assistant U.S. Attorneys David T. Huang and Larysa J. Kern are handling the prosecution.

U.S. Attorney David X. Sullivan and FBI Special Agent in Charge P.J. O’Brien announced the charges. Khaydarov has pleaded not guilty, and the charges are allegations. Investigators have not publicly identified the affected carriers, brokers, shippers or distribution facilities. Authorities also have not disclosed how participants acquired control of the trucking businesses.

The announcement leaves the recovery status of the stolen merchandise unresolved. Anyone with relevant information can contact the FBI’s New Haven Field Office at 203-777-6311.

window.googletag = window.googletag || {cmd: []};
googletag.cmd.push(function() {
var gptSlot = googletag.defineSlot(‘/21776187881/fw-responsive-main_content-slot4’, [[300, 100], [320, 50], [728, 90], [468, 60]], ‘div-gpt-ad-1709668086344-0’).defineSizeMapping(gptSizeMaps.banner1).addService(googletag.pubads());
googletag.pubads().enableSingleRequest();
googletag.pubads().collapseEmptyDivs();
googletag.enableServices();
setInterval(function() {
if (!document.hidden) { googletag.pubads().refresh([gptSlot]); }
}, 60000);
});

googletag.cmd.push(function() { googletag.display(‘div-gpt-ad-1709668086344-0’); });

Why It Matters

This case shows how criminals can exploit established carrier identities to obtain freight through legitimate brokerage transactions. Existing DOT numbers, operating histories and business email accounts cannot independently establish who controls a transportation company.

CFCO

In my opinion, this case reinforces why verification must go beyond an active DOT number. The Certified Fraud Compliance Officer (CFCO) course teaches a five-layer process to identify inconsistencies before freight changes hands. Technology helps, but trained employees must know what to question and when to stop.

Click here for more articles on cargo theft and freight fraud by Phil Brink.

Nearly $1M in Pokémon and sports cards vanish from FedEx truck, driver discovers missing lock – FreightWaves

Failed CDL exams, $3,000 payments and Bluetooth cheating scheme lead to federal charges – FreightWaves

25 charged after drug ring used unsuspecting truckers to haul cocaine from California to Florida – FreightWaves

window.googletag = window.googletag || {cmd: []};
googletag.cmd.push(function() {
var gptSlot = googletag.defineSlot(‘/21776187881/fw-responsive-main_content-slot5’, [[728, 90], [468, 60], [320, 50], [300, 100]], ‘div-gpt-ad-1665767778941-0’).defineSizeMapping(gptSizeMaps.banner1).addService(googletag.pubads());
googletag.pubads().enableSingleRequest();
googletag.pubads().collapseEmptyDivs();
googletag.enableServices();
setInterval(function() {
if (!document.hidden) { googletag.pubads().refresh([gptSlot]); }
}, 60000);
});

googletag.cmd.push(function() { googletag.display(‘div-gpt-ad-1665767778941-0’); });

The post Feds charge driver in alleged $12M cargo theft scheme built on hijacked carrier identities appeared first on FreightWaves.

Source: FreightWaves