An August 2024 ransomware attack disrupted JAS Worldwide’s freight-forwarding technology and customer services. Central systems returned in stages, but backlogs and local issues persisted into early September; attribution and data impact remain unresolved.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
A specific application or software platform became unavailable or unusable.
The organization could not process, receive, issue, reconcile, or record payments normally.
Transit, aviation, rail, maritime, logistics, fleet, traffic, ticketing, or related transportation operations were materially affected.
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
JAS Worldwide experienced a confirmed ransomware attack that disrupted freight-forwarding systems and customer services in August 2024. The Atlanta-based company publicly identified ransomware on Aug. 27, according to its statement reproduced by the Canadian Society of Customs Brokers and FreightWaves. The exact initial intrusion and discovery times remain unknown.
The disruption affected business technology used to serve shippers, with recovery occurring in stages. No reviewed evidence identifies a responsible group or confirms a ransom payment. The company’s ransomware finding supports high confidence in that classification without establishing a particular encryption scope, access method or data-theft outcome.
The affected environment included central operations and the customer portal, with billing, payments and customer or vendor integrations addressed during recovery. Early-September reporting reproduced the company’s account that most integrations had returned while local functions and accumulated requests still needed attention. These findings concern logistics administration and service delivery; they do not establish that all shipments stopped.
Email and the public website continued operating, and most contract-logistics operations were unaffected. TechTarget reported that the central operations system, C1, returned Aug. 30. Restoring that system was a substantial milestone, but it did not establish that every customer issue or backlog had cleared.
Confidence is high in the cyberattack and operational disruption because multiple contemporaneous publications reproduced the victim’s statements. ICSSTRIVE’s Sept. 4 account carried the company’s statement that essential systems and SmartHub were restored, alongside continuing work on backlogged requests and specific customer issues. The account qualifies a universal-restoration interpretation of the essential-systems milestone.
Attribution remains unresolved. No responsible group has been identified in the available evidence. The Loadstar’s credential-exposure reporting raises a possible risk context but does not establish that those records came from this incident or that credentials enabled the intrusion. Speculation about a payment based on the absence of a public claim does not establish a payment.
Sept. 4 is the latest verified dated account of residual operational effects in the reviewed record. No source establishes when the final backlog and local issues were resolved, so the incident is presumed resolved based on elapsed time, with no exact end date asserted. Later reporting dates and security improvements do not independently extend the disruption.
The initial access path, compromised-system inventory, confirmed data exposure, ransom demand, payment outcome and full geographic scope remain unverified. Statements about a global operating network do not establish identical effects at every subsidiary or facility. Dated restoration records, incident-response findings or specific disclosures would help resolve these gaps.
The JAS group’s 2024 GDP certificate lists a U.S. forwarding office at 800 Airport Blvd., Suite 518, in Burlingame. This identifies an operating site of the affected group; reporting does not establish a facility-specific outage.
Los Angeles County contains the JAS group’s certified U.S. forwarding office at 1975 Charles Willard St. in the unincorporated Rancho Dominguez area. This identifies an operating site of the affected group; reporting does not establish a facility-specific outage.
San Mateo County contains the JAS group’s certified U.S. forwarding office at 800 Airport Blvd., Suite 518, in Burlingame. This identifies an operating site of the affected group; reporting does not establish a facility-specific outage.
Miami-Dade County contains the JAS group’s certified U.S. forwarding office at 1900 NW 129th Ave., Suite 100, in Sweetwater. This identifies an operating site of the affected group; reporting does not establish a facility-specific outage.
The JAS group’s 2024 GDP certificate lists a U.S. forwarding office at 1900 NW 129th Ave., Suite 100. The address uses a Miami mailing label but is in Sweetwater. This identifies an operating site of the affected group; reporting does not establish a facility-specific outage.
The JAS group’s 2024 GDP certificate lists a U.S. forwarding office at 4900 St. Joe Blvd., Building 100, Suite 400. The address uses an Atlanta mailing label but is in College Park. This identifies an operating site of the affected group; reporting does not establish a facility-specific outage.
Fulton County contains the affected group’s Sandy Springs headquarters.
The affected logistics group’s global headquarters is at 6195 Barfield Road in Sandy Springs.
DuPage County contains the JAS group’s certified U.S. forwarding office at 1555 N. Mittel Blvd. in Wood Dale. This identifies an operating site of the affected group; reporting does not establish a facility-specific outage.
The JAS group’s 2024 GDP certificate lists a U.S. forwarding office at 1555 N. Mittel Blvd. in Wood Dale. This identifies an operating site of the affected group; reporting does not establish a facility-specific outage.
Nassau County contains the JAS group’s certified U.S. forwarding office on the third floor of 500 Rockaway Ave. in Valley Stream. This identifies an operating site of the affected group; reporting does not establish a facility-specific outage.
The JAS group’s 2024 GDP certificate lists a U.S. forwarding office on the third floor of 500 Rockaway Ave. in Valley Stream. This identifies an operating site of the affected group; reporting does not establish a facility-specific outage.
Charleston County contains the JAS group’s certified forwarding office at 4289-A Crosspoint Drive in North Charleston. This identifies an operating site of the affected group; reporting does not establish a facility-specific outage.
The JAS group’s 2024 GDP certificate lists its Charleston forwarding office at 4289-A Crosspoint Drive. The address uses a Ladson mailing label but is in North Charleston. This identifies an operating site of the affected group; reporting does not establish a facility-specific outage.
We reported the Aug. 27 ransomware confirmation, technical disruption and continuing recovery. Our reporting identified no responsible group and described some services as still affected.
Reports JAS’s Aug. 27 service-interruption announcement and the company’s finding that ransomware caused the incident. No restoration estimate was available.
Reproduces JAS’s Aug. 27 ransomware confirmation and describes disruption to customer services. Its Aug. 29 update said the company’s email and website remained secure.
Describes restored central operations, billing and payment functions, and most customer and vendor integrations. The company continued addressing backlogged requests and local system issues.
Reproduces a Sept. 2 company statement describing restored core functions alongside remaining requests and local issues. It also reports credential-exposure observations and an unnamed source’s payment speculation.
Reproduces the company’s Sept. 4 statement that essential systems and SmartHub were restored, while backlogged requests and specific customer issues were still being addressed.
The JAS section reports restoration of the C1 central operations system Aug. 30 and essential systems by Sept. 4. Email and the public website were unaffected.
Signed-in members can report an error, update, or missing source.
