Driver Charged in $12M Cargo Theft Scheme Using Stolen Carrier Identities
Feds charge driver in alleged $12 million cargo theft scheme built on hijacked carrier identities
Federal prosecutors have charged a commercial driver in an alleged cargo theft conspiracy that involved at least 24 freight shipments and more than $12 million in estimated retail losses.
Authorities say the scheme relied on established trucking companies rather than newly created carrier identities. Investigators allege that participants took control of existing motor carriers, obtained access to their U.S. Department of Transportation numbers, motor carrier identification numbers, business email accounts and ownership information, and then used those credentials to secure legitimate freight from brokers.
Drivers collected shipments from distribution centers, but the cargo did not reach its scheduled destinations. The missing freight included hard drives, stereo equipment, clothing, electronics, computer equipment, food, nicotine products and other consumer goods.
The U.S. Attorney’s Office for the District of Connecticut announced federal charges against Nursulton Khaydarov, 33, on Oct. 21. Khaydarov, a citizen of Uzbekistan and lawful permanent resident of the United States, pleaded not guilty in federal court in Bridgeport, Connecticut. He has remained in custody since his arrest in California on June 1.
A grand jury in New Haven returned an indictment Sept. 22. Khaydarov is charged with conspiracy, an offense carrying a maximum sentence of five years in prison. The charges remain allegations, and the government must prove them in court.
How investigators say the scheme worked
According to federal court documents, the alleged operation began around September 2025 and involved multiple motor carriers. Prosecutors say participants purchased trucking businesses or otherwise assumed control of their operations. They then impersonated previous owners while negotiating interstate transportation contracts with freight brokers.
Using an established carrier identity could give the participants access to operating histories, existing broker relationships and other information that appeared legitimate during routine onboarding. Investigators contend that the approach allowed the group to obtain loads through normal freight transactions without immediately raising the concerns that might accompany a newly formed carrier.
After a driver picked up a shipment, the freight allegedly disappeared before delivery. Court documents describe attempts to conceal the activity, including switching tractor license plates, using burner phones and encrypted messaging applications, and interfering with electronic shipment-tracking systems. Investigators also say participants offered false explanations for delayed or missing loads.
Federal authorities documented ransom demands involving some of the stolen shipments. Prosecutors allege that participants requested cryptocurrency or electronic payments in exchange for returning merchandise. An FBI affidavit identified about $121,000 in cryptocurrency received by a Coinbase account associated with Khaydarov across 33 transactions between November 2025 and May 2026. Investigators have not established that every transaction represented a ransom payment.
Multiple identities and a California traffic stop
Investigators also found several fraudulent driver’s licenses connected to Khaydarov. Court documents say five different names appeared on the licenses, each displaying his photograph with altered facial features. Authorities also confirmed that Khaydarov held a valid New Jersey commercial driver’s license.
One case described in the documents involved a shipment of pistachios picked up in Terra Bella, California, for delivery to Laredo, Texas, on Dec. 19, 2025. Investigators say the driver presented an Illinois license identifying him as Sayid Makhmudarov. State records showed no matching license, and photographs connected the document to Khaydarov, according to the affidavit.
On May 18, police in Ontario, California, located a tractor-trailer that investigators linked to suspected cargo thefts. During a traffic stop, Khaydarov identified himself with his valid New Jersey license. Officers allegedly found suspected counterfeit identification and a nicotine product matching merchandise from an earlier theft.
Police impounded the tractor-trailer, and FBI agents later searched it under a federal warrant. Investigators say the vehicle and its license plate were connected to the broader investigation involving at least 24 shipments.
Why the case matters to drivers and carriers
The allegations illustrate how cargo theft can begin before a truck reaches a pickup location. When criminals use a real carrier’s identity, the driver may arrive with apparently valid dispatch information and legitimate load paperwork while being unaware of the larger scheme.
The case also highlights the limits of relying on an active DOT number or a carrier’s years of operating history. Those records can confirm that a company exists, but they do not necessarily show who currently controls the business or who is communicating with brokers and drivers.
Recent ownership changes, new contact information, unfamiliar email domains, insurance changes and inconsistencies among registration records can all require additional verification. For drivers, unexpected changes to pickup or delivery instructions, demands to bypass normal tracking procedures, or requests to use different identification should receive careful attention and be confirmed through established contacts.
The FBI is leading the investigation with assistance from Homeland Security Investigations, IRS Criminal Investigation, the U.S. Department of Transportation’s Office of Inspector General, and police departments in Fullerton and Ontario, California.
Authorities have not publicly identified the affected carriers, brokers, shippers or distribution facilities. They also have not disclosed how the participants allegedly acquired control of the trucking businesses or whether all of the stolen merchandise has been recovered.
