Driver Charged in Alleged $12M Cargo Theft Using Hijacked Carrier IDs

How did criminals steal $12 million in freight using legitimate carrier identities?

Federal prosecutors charged Nursulton Khaydarov, 33, with participating in an alleged cargo theft conspiracy that stole at least 24 shipments worth more than $12 million in retail value. Investigators say the group bought or assumed control of established trucking companies, then impersonated the previous owners to negotiate freight contracts with brokers. Drivers collected shipments from distribution facilities, but the cargo never reached its scheduled destinations.

The U.S. Attorney's Office for the District of Connecticut announced the charges on October 21. Khaydarov, a citizen of Uzbekistan and lawful permanent resident of the United States, pleaded not guilty during an appearance in federal court in Bridgeport, Connecticut.

The Mechanics: Buying Established Carriers to Bypass Vetting

According to federal investigators, the operation began around September 2025. Participants purchased trucking businesses or otherwise assumed control of their existing operations. They obtained U.S. Department of Transportation numbers, motor carrier identification numbers, business email accounts and ownership identities. The group then impersonated previous owners to negotiate transportation agreements with freight brokers.

The suspects relied on established business identities rather than creating entirely new trucking companies. Prosecutors contend that these arrangements allowed participants to exploit existing reputations and relationships within the freight industry. Brokers negotiated interstate transportation contracts with individuals posing as legitimate carrier representatives. After drivers collected the merchandise, the shipments disappeared before reaching their scheduled delivery locations.

The scheme resembles a growing problem involving the buying and selling of established trucking companies. Some operators acquire existing businesses to obtain operating histories, established credentials and relationships with freight brokers. Older authorities may pass routine vetting more easily because their federal records already show years of activity. FMCSA has warned against buying, selling or leasing operating authority outside legitimate corporate transactions.

What Brokers Missed

For freight brokers, the challenge extends beyond confirming an active DOT number or valid insurance. Recent ownership changes, updated contact information and unfamiliar email domains can warrant additional verification. Insurance changes and inconsistencies between registration records also deserve closer examination. An established operating history means little if brokers cannot verify who actually controls the company.

The indictment describes additional steps participants allegedly took to conceal their activities. Prosecutors accuse the group of switching tractor license plates and using burner phones with encrypted messaging applications. Court records also describe efforts to defeat electronic shipment tracking systems. Investigators contend that participants provided false explanations about delayed or missing freight after completing pickups.

Ransom Demands and Cryptocurrency Payments

Federal investigators also documented ransom demands involving stolen shipments. According to the indictment, participants requested cryptocurrency or electronic transfers in exchange for returning merchandise. An FBI affidavit identifies approximately $121,000 in cryptocurrency that Khaydarov's Coinbase account received across 33 transactions. Those payments occurred between November 2025 and May 2026, although investigators did not establish that every transfer represented ransom.

The stolen merchandise covered several categories of commercial freight. Prosecutors identified hard drives, stereo equipment, clothing, electronics and computer equipment among the missing products. Other shipments contained food items, nicotine products and additional consumer goods. Investigators attributed more than $12 million in estimated retail losses to thefts involving Khaydarov personally.

Five Fake Licenses, One Photograph

Federal court documents also describe several fraudulent driver's licenses connected to Khaydarov. Authorities identified five different names appearing on those documents. Each license displayed his photograph with altered facial features. Investigators also confirmed that he possessed a valid New Jersey commercial driver's license.

One documented incident involved a pistachio shipment departing Terra Bella, California, for Laredo, Texas, on December 19, 2025. Investigators reported that the driver presented an Illinois license identifying him as Sayid Makhmudarov. State motor vehicle records showed no matching license, and photographs connected that document to Khaydarov. California's pistachio industry has faced growing concerns over cargo theft, particularly during harvest season when high-value shipments enter transportation networks.

On May 18, police in Ontario, California, located a tractor-trailer associated with suspected cargo thefts. During a traffic stop, Khaydarov identified himself using his valid New Jersey driver's license. Officers discovered suspected counterfeit identification and a nicotine product matching merchandise from an earlier theft. Police impounded the equipment, and FBI agents subsequently searched the tractor under a federal warrant.

Arrest and Charges

Federal authorities arrested Khaydarov in Ontario, California, on June 1, 2026, following a criminal complaint. A grand jury in New Haven, Connecticut, returned an indictment on September 22. The indictment charges him with conspiracy, which carries a maximum prison sentence of five years. He has remained in custody since his arrest.

The FBI leads the investigation with assistance from several federal and local enforcement partners. Participating agencies include Homeland Security Investigations, IRS Criminal Investigation and the U.S. Department of Transportation's Office of Inspector General. Police departments in Fullerton and Ontario, California, also contributed investigative resources. Assistant U.S. Attorneys David T. Huang and Larysa J. Kern are handling the prosecution.

U.S. Attorney David X. Sullivan and FBI Special Agent in Charge P.J. O'Brien announced the charges. Khaydarov has pleaded not guilty, and the charges are allegations. Investigators have not publicly identified the affected carriers, brokers, shippers or distribution facilities. Authorities also have not disclosed how participants acquired control of the trucking businesses.

The announcement leaves the recovery status of the stolen merchandise unresolved. Anyone with relevant information can contact the FBI's New Haven Field Office at 203-777-6311.

What to Verify Before You Sign the Rate Con

This case shows how criminals can exploit established carrier identities to obtain freight through legitimate brokerage transactions. Existing DOT numbers, operating histories and business email accounts cannot independently establish who controls a transportation company.

Brokers should verify recent ownership changes, updated contact information and unfamiliar email domains before tendering loads. Insurance changes and inconsistencies between registration records deserve closer examination. When a carrier's email domain, phone number, or contact person changes without explanation, stop and verify directly with the previous contact before moving forward. An active DOT number means nothing if the company behind it changed hands last month and you never checked who bought it.

Carriers should watch for double-brokering schemes using hijacked identities. If a broker contacts you about a load you never bid on, or if you receive payment for a shipment you never hauled, your MC number may be compromised. Check your FMCSA registration for unauthorized changes and report identity theft immediately.