Spanish law enforcement has broken up a criminal organization accused of stealing cargo from moving trucks on major road corridors. The operation, carried out by Guardia Civil under the wider CERES 2.0 security framework, targeted a group that used modified vehicles and a dangerous method known in Spain as the “surfer” technique.
According to Guardia Civil, ten men were arrested as suspected perpetrators of eleven robberies committed between February and May in the provinces of Cáceres, Cuenca, Huesca, Toledo and Murcia. The total value of stolen goods is estimated at €481,000.
The most significant case was the theft of a tobacco shipment on the AP-36 motorway near Quintanar de la Orden in Toledo. The value of that cargo alone was estimated at €400,000.
The case is important not only because of the amount stolen, but also because of the way the group operated. Unlike standard cargo theft, where criminals target parked trucks at service areas or industrial zones, this organization allegedly attacked vehicles while they were still on the road. That made the method extremely dangerous for drivers, other road users and the criminals themselves.
As K2Cargo News previously reported in New Report Reveals Widespread Problems in Europe’s International Road Transport Sector, safety, working conditions and security remain major challenges for European road freight. The Spanish case shows that cargo crime is becoming not only more organized, but also more mobile and technologically prepared.
How the Group Operated
Guardia Civil described the group as highly specialized and extremely cautious.
The suspects reportedly moved across several European countries and avoided staying in one place for long. They changed routes, transport methods and accommodation, and used false documents to rent housing and hide their identities.
The organization had bases in several EU countries, including France, Italy, Germany and the United Kingdom. This gave the group mobility and made it harder for investigators to track movements, logistics and possible storage points.
The gang allegedly used vehicles modified for cargo theft. Some vehicles were used for observation and traffic manipulation, while a specially adapted vehicle allowed members of the group to approach the rear of a target truck while it was moving.
The purpose was to access the cargo area without the driver realizing what was happening. Stolen goods were then transferred to another vehicle supporting the operation. In many cases, drivers did not notice the theft until they reached their destination.
This type of crime shows how vulnerable road freight can be when cargo, vehicle movement and driver visibility are exploited at the same time.
Why Moving-Truck Theft Is Especially Dangerous
Theft from moving trucks is one of the most dangerous forms of cargo crime.
A standard cargo theft from a parked vehicle is already costly and disruptive. But an attack on a moving truck adds a serious road safety risk. The targeted driver may not realize that the vehicle is being approached from behind. Other vehicles may be forced to slow down or change lanes. Any sudden maneuver can lead to an accident.
For logistics companies, the risk is therefore double. There is the direct loss of cargo, but also potential damage to vehicles, injuries, insurance disputes, delivery failures and reputational harm.
The Spanish case also shows that cargo criminals are adapting. Instead of relying only on night-time parking thefts, they are using coordinated vehicle movement, cross-border mobility and specialized equipment. This makes detection harder and requires a more sophisticated response from law enforcement and transport companies.
Cargo Worth €481,000 Was Stolen
The group is suspected of eleven robberies across five provinces.
The stolen goods were valued at €481,000. The most serious single case involved a truck carrying tobacco on the AP-36 motorway near Quintanar de la Orden in Toledo, where losses reached around €400,000.
Tobacco remains an attractive target for organized cargo theft because it is valuable, easy to resell and difficult to trace once broken into smaller lots. But the group also targeted other goods, including electronics. During the final stage of the investigation, officers recovered televisions stolen in the latest robbery and returned them to their legal owner after verifying their origin.
The recovered items and seized vehicles give investigators an opportunity to connect the suspects to additional cases. In cargo crime investigations, physical evidence, vehicle tracking, communications systems and stolen goods can help build a wider picture of the network.
Cross-Border Crime Requires Cross-Border Response
The operation, named New Moon-Ceres, was carried out by Guardia Civil’s CERES investigation group in cooperation with Romania’s Interior Ministry, Europol, the Guardia Civil Reserve and Security Group from Valencia and the Technical Unit of Judicial Police.
This international cooperation is important because the group did not operate as a local gang. According to Spanish authorities, it had links and bases across several countries and used mobility as a way to avoid detection.
One of the arrested suspects was also subject to a European arrest warrant issued by authorities in Romania and Austria.
For European logistics, this is a familiar problem. Trucks move across borders every day, but criminal networks can do the same. If cargo thieves use multiple countries for movement, accommodation, resale and document fraud, national police forces need fast information exchange and coordinated operations.
Europol’s involvement reflects the scale and transnational character of the case.
What Was Seized
During searches, Guardia Civil seized a van and a truck that had allegedly been modified to support the robberies. Officers also recovered radio communication systems, license plates from different countries, specialized tools and stolen televisions from the latest theft.
The seized equipment shows that the group had prepared its operations carefully. Multiple vehicles, communication tools and false plates are typical indicators of an organized structure rather than isolated theft.
For transport companies, this confirms that cargo crime should be treated as a professional risk. It cannot be managed only by telling drivers to be careful. Companies need route analysis, secure parking strategies, cargo tracking, driver training and cooperation with police and insurers.
A Warning for Carriers in Europe
The Spanish case sends a clear warning to road freight operators.
Cargo theft is no longer limited to parked trucks in poorly lit rest areas. Criminal groups are using more aggressive and mobile methods, especially on routes carrying high-value goods. Tobacco, electronics, clothing, consumer goods and branded products can all be targets.
Carriers should review high-risk routes, especially where past incidents have occurred. Drivers should be trained to report suspicious vehicles, unusual behavior and attempts to manipulate traffic around them. Fleet operators should also strengthen the use of telematics, dashcams, real-time tracking and communication protocols.
At the same time, this is not only the responsibility of carriers. Secure infrastructure, safe parking areas, better surveillance, cross-border police cooperation and fast reporting channels are essential for reducing cargo crime.
Security Becomes Part of Logistics Strategy
The dismantling of this group shows that cargo security is now a strategic issue for European road transport.
A stolen load does not only affect the value of the goods. It disrupts delivery schedules, increases insurance costs, damages customer trust and can put drivers at risk. When criminals attack moving trucks, the threat becomes even more serious because it directly intersects with road safety.
The arrests in Spain are a strong law-enforcement result, but they also highlight a wider market challenge. As logistics networks become more complex and cargo moves faster across borders, criminal groups are also becoming more mobile and better organized.
For transport companies, the conclusion is clear: security must be integrated into everyday fleet operations. Route planning, driver communication, cargo monitoring and incident reporting are no longer optional. They are part of protecting the supply chain.
Spain’s Operation New Moon-Ceres may have stopped one specialized group, but the broader lesson applies across Europe. Cargo crime is evolving, and logistics security must evolve with it.
Read also: New Report Reveals Widespread Problems in Europe’s International Road Transport Sector
