When a Cyberattack Hits Your Fleet: What Happens Next?

As fleet managers add connected vehicles to their ranks, their vulnerability to cyberattacks keeps rising. With AI becoming mainstream and new digital threats emerging every day, a cyberattack contingency plan isn’t just a good idea; it is necessary for driver and fleet safety.

According to Palo Alto Networks’ Unit 42 2026 Global Incident Response Report, the fastest 25% of intrusions investigated in 2025 successfully transferred, copied, or removed data from the victim organization in 1.2 hours, compared with 4.8 hours the previous year. The findings highlight how quickly a security incident can escalate, leaving organizations with less time to identify and contain a threat.

We spoke with Troy Bettencourt, vice president of Digital Forensics and Incident Response at Palo Alto Networks’ Unit 42, to learn what fleet managers should do if their operation gets hacked.

This interview has been edited for length and clarity.

Q: A fleet manager arrives at work and discovers that critical systems are unavailable. What should they do in the first 30 minutes if they suspect the outage may be the result of a cyberattack, and what actions should they avoid taking?

Bettencourt: When critical systems go dark, an organization faces a potential business crisis. The first 30 minutes are crucial and should follow an established incident response playbook.

An incident response playbook should clearly outline who to contact and establish key priorities, starting with addressing any life and safety risks, restoring business operations, containing the threat, and conducting root cause analysis.

Employees should not attempt to fix or contain the issue independently. Standard instincts like rebooting machines or altering files can erase important log data that the security team needs. General guidance is to contain the threat while preserving data for deeper analysis, and those efforts should always be directed by the security team, not executed independently.

Q: Once a cyberattack is confirmed, how should a fleet manager work with IT or incident response teams to determine which fleet systems, connected devices, and vehicles can safely remain in operation, and which should be isolated or taken offline? What information can fleet provide to help make those decisions?

Bettencourt: IT and incident response teams rely heavily on the fleet manager’s domain expertise and understanding of daily operations. Technical teams will likely need access to fleet management platforms, telemetry, and log data to understand the cause of the breach and its impact on the organization. The security team can share which systems and platforms the threat actor accessed and what actions they took.

However, security specialists often lack the operational context to understand how the threat actor’s actions translate into real-world impact. This is where close, continuous collaboration is essential. As security team members uncover more evidence of what the threat actors did, fleet managers can advise them on the potential operational impacts and jointly develop response actions. Those actions may include platform configuration changes, blocking services like over-the-air commands, suspending fleet fuel cards, or, in rare, high-risk scenarios, initiating a fleet stand-down.

Q: If critical fleet technology must remain offline for hours or days, what should an effective business-continuity plan include to keep vehicles safely operating? Are there specific records, data, manual processes, or backup communication methods fleets should have available before an incident occurs?

Bettencourt: An effective business continuity plan centers on a Business Impact Analysis that identifies what technology is required for a Minimally Viable Business (MVB).

An MVB is the bare minimum required to keep operations functioning enough to meet stakeholder demands while restoring systems in parallel. Stakeholders can include regulators, leadership, employees, business partners, and customers.

Organizations should understand what the MVB requires to meet those stakeholder expectations and then design suitable alternate processes. These workflows should be prepared to function not just for hours or days, but potentially for weeks or months.

Key areas to prepare in advance include:

• Backup procedures for any life, health, and safety risks.
• Secondary, out-of-band communication methods.
• Manual payment processes for fuel, maintenance, and payroll.
• Paper logs for driver mileage, hours of service, and expenses.
• Alternate reporting methods to maintain compliance with regulators and business partners.
• Practical logistics for long-haul drivers, such as manual booking and payment options for lodging and meal per diems.

Unless teams practice the plan regularly, most organizations unfortunately find that a comprehensive plan on a shelf does not translate into an effective response. Exercises should be realistic rather than theoretical, requiring staff to run through the manual steps to confirm they work.

There is a saying in cybersecurity, “You have two opportunities to test your plans: when you choose or when the threat actor chooses.” It is always best that you choose.

Q: During an active cyber incident, what should fleet managers document about affected systems, vehicles, operational disruptions, workarounds, and unusual activity? How can that information assist the larger incident-response and recovery effort?

Bettencourt: Fleet managers are often the subject matter experts of their systems and daily operations. Process maps, connectivity diagrams, and system telemetry may use industry terminology that security teams don’t understand. The context that a fleet manager provides can be the difference in the timeliness and effectiveness of the entire response and recovery effort.

Because every incident is unique, the general recommendation is to document everything as it happens and avoid changing system configurations unless necessary for life and safety or explicitly directed by the response team. Helpful items to record include:

• Timelines of unusual system alerts and direct user reports of software or hardware issues.
• Suspicious phone calls or outreach, such as third parties attempting to gather details about ongoing response efforts.
• Operational workarounds and manual procedures deployed to keep vehicles moving.

If a fleet manager must make an emergency change to a system or vehicle setting, documenting that action is critical. Security specialists frequently review network activity to separate normal user behavior from an intruder using compromised credentials. When fleet managers maintain a clear, timestamped record of their own actions, security analysts can easily verify legitimate administrative activity against potential unauthorized behavior.

Q: Now consider a different scenario: the fleet’s organization has not been breached, but a critical third-party provider reports a cyberattack. What information should the fleet manager immediately request from that provider to understand the potential impact on their own operation, data, credentials, and connected systems?

Bettencourt: Third-party or nth-party risk has become far more common as operations grow more integrated and reliant on outside vendors. Fleet managers should work with their internal security team and the breached third party to understand what risks the breach creates.

For example, if that third party has direct access to your environment through virtual private networks, shared resources, or cloud assets, the risk is potentially much greater. If they only receive one-way information from you, such as a shipping provider who just receives basic dispatch details you send to them, then your operational risk is much lower.

Keep in mind that getting these answers quickly can be challenging. The affected provider is often still investigating the scope of the incident, and their legal counsel may advise them to limit disclosures while facts are gathered.

The best defense here is proactive contract management. Organizations should establish contract language with key vendors that mandates prompt incident notification and outlines specific technical details they must share during a disruption. Without those clauses in place beforehand, organizations frequently face long delays while legal, security, and executive teams on both sides try to negotiate what information can be shared during an active event.

Q: If a third-party provider has been compromised, how should an organization determine whether to disconnect integrations or credentials associated with that vendor? What steps can fleet managers take to reduce the risk that a vendor compromise spreads into their own environment while still maintaining essential operations?

Bettencourt: I recommend a risk-based analysis. A common industry challenge is that organizations do not always have full visibility into the exact nature of their third-party connections, integrations, and account permissions. Without that knowledge, even when a compromised third party shares information about their breach, the requesting party does not know what their own risk is. This is further compounded by the rapidly moving, oft-changing nature of a large security incident and the time pressures that come from business disruption.

Fleet managers can minimize a significant amount of risk by simply avoiding bi-directional connectivity between their own organization and third parties, if practicable. When two-way access is unavoidable, organizations can still protect themselves by applying the principle of least privilege to third-party accounts and using technical controls to prevent movement into other areas of the network. With these protections, it is much more difficult for a threat actor to move from a third-party to a fleet manager’s systems and take unauthorized actions.

Q: Whether the attack affected the fleet directly or originated with a vendor, what should happen before fleet systems, integrations, and connected devices are brought back online? What are the most common recovery mistakes organizations make that could expose them to additional risk or reinfection?

Bettencourt: The decision to restore systems is heavily dependent on the nature of the breach, including what the threat actor was confirmed to have accomplished as well as any lingering unknowns. Most incidents leave some unanswered questions simply due to a lack of complete evidence.

Understanding what the threat actor was confirmed to have done, and what evidence indicates may have been possible, should help guide fleet managers’ decisions. As with earlier guidance, fleet managers should not operate in a vacuum and should work closely with their security teams to translate the technical findings into real-world risks.

Once those risks have been identified and prioritized, the combined team can decide what response actions best balance operational needs with security concerns. In some incidents, a simple password reset might be sufficient. In others, severing a connection to a third-party until the risk is determined acceptable and reconnection authorized may be the most prudent course of action.

Some of the common issues we see with response and recovery are:

• Restoring business operations and reconnecting systems before the threat actor has been completely contained.
• Insufficient containment, leaving pathways open for unauthorized access to persist.
• Misalignment of priorities and slow decision-making between technical teams, operational managers, and executive leadership.
• Difficulty translating technical cybersecurity risks into practical business decisions.
• Managing legacy platforms that lack vendor support or sufficient internal documentation.

The best way to prevent these missteps during recovery goes back to preparation. Incident playbooks, offline continuity procedures, and joint communication channels cannot just sit on a shelf.

Organizations need to exercise them under realistic conditions well before an incident happens. That preparation bridges the gap between technical security and daily operations, ensuring that when systems do come back online, they stay safe and the business keeps moving.