As transport becomes more digital, criminals have found new ways to attack supply chains — from identity theft to scams involving fake carriers. However, the latest Spanish operation highlights a parallel reality: traditional attacks on trucks have not disappeared from Europe’s roads. Specialised teams can still target vehicles in transit and remove goods without the driver noticing until the next stop — or even until unloading.
A cross-border group with a footprint in multiple EU countries
Guardia Civil arrested ten suspected members of an organised criminal group believed to be behind eleven thefts in Spain between February and May 2026. Investigators estimated the value of the stolen cargo at €481,000.
According to Spanish authorities, the organisation maintained support networks in several countries, including France, Italy, Germany and the United Kingdom. Members reportedly rotated roles, used rented flats and vehicles, and relied on false identities to make identification and tracking more difficult.
How the “surfer” method works
Investigators said the thieves used a specially adapted vehicle to carry out the raids. While driving, they would close in on a chosen truck at points where it had to slow down — such as uphill stretches or changes in road gradient.
One offender would climb out of the modified vehicle, brace himself on the bonnet, and cut through the trailer’s security using an angle grinder or a similar tool. He would then enter the trailer, select part of the load, and pass it back to an accomplice in the gang’s vehicle.
The thefts were carried out while both vehicles were in motion. In most cases, the driver only realised something was missing at the next rest stop or after arriving at the delivery point.
Two additional high-powered cars were used to manage traffic and slow vehicles down, isolating the targeted lorry and making it easier to carry out the theft.
Arrests followed a theft of televisions
On 13 June, officers learned that several members of the group had travelled to Spain and rented a house in Cox, in Alicante province, which was used as an operational base. During the night of 16–17 June, the suspects attacked a lorry travelling on the A-7 motorway towards Madrid, stealing 16 televisions. The next day, Guardia Civil searched the rented house and detained ten people.
During the search, officers seized the modified van and a truck used in the attacks. They also recovered the goods stolen the previous day, along with tools, communications equipment and number plates from different countries.
Stolen goods worth nearly half a million euro
Investigators linked the detainees to thefts in the provinces of Cáceres, Cuenca, Huesca, Toledo and Murcia. The total value of the stolen loads was €481,000, with the biggest single incident involving tobacco products worth €400,000 taken from a lorry in Quintanar de la Orden, in Toledo province.
The suspects face charges related to offences against property. One of those arrested was also the subject of an international search warrant issued by Austria and Romania. A court in Orihuela ordered the suspects to be held in pre-trial detention.
Physical cargo theft remains a risk
While the transport and logistics sector has recently been grappling mainly with a sharp rise in cybercrime — including fake-carrier fraud and scams carried out via freight platforms — the Spanish operation shows that conventional cargo theft remains a serious threat.
The case indicates that, even as cyber risks grow, organised gangs continue to rely on physical methods. Breaking into trailers while a vehicle is moving remains one of the risks carriers still need to plan for.
