Key Takeaways
- Auto import brokers hold VINs, CUSMA certificates, and CARM portal credentials that can enable customs fraud if stolen.
- CBSA holds importers of record liable for fraudulent CADs filed under their number, regardless of who had the login.
- Most importers never audit broker identity controls or CARM delegation, which is the gap social engineering attacks exploit.
- Verify your broker uses individual logins, encrypts origin documentation, and has a credential revocation process you can trigger in hours.
What the Helix breach exposed
The Helix extortion group's claim that it lifted nearly a million files from Uber Freight using nothing more sophisticated than a phone call should wake up every importer who runs automotive shipments through Canada. An auto import broker holds some of the most fraud-ready data in your supply chain: vehicle identification numbers, CUSMA origin declarations, importer of record credentials, and the CARM Client Portal access that files your Commercial Accounting Declarations. If a freight platform this size can be compromised by impersonating IT support, the broker relationship you barely audit is an open door.
Uber Freight confirmed on August 12 that it is investigating unauthorized access to its systems. The attack vector was not a zero-day exploit or nation-state malware. It was social engineering: someone called the helpdesk, sounded credible, and walked out with credentials. The files allegedly include shipment records, customer data, and internal communications. For Canadian importers moving automotive goods, that kind of dataset can include VINs, purchase invoices, duty calculations, and origin certificates—everything a customs fraud scheme needs to file false CADs or manipulate RPP bond claims.
The breach is still under investigation, but the risk model is already clear. Managed transportation platforms aggregate data from dozens of importers and hundreds of shipments. A single compromised account can expose months of trade history. For automotive imports specifically, where CBSA verification of CUSMA origin often involves production records and supplier declarations, a breach could give bad actors the documentation to fabricate duty-free claims on non-originating parts.
Why auto import brokers hold high-value trade data
An auto import broker does not just file paperwork. They hold importer of record credentials, access your CARM Client Portal account (or file under your delegated authority), calculate duty drawback eligibility for re-exported vehicles, and maintain four years of customs documentation per CBSA retention rules. That data includes:
- VINs and manufacturer invoices for every imported vehicle or auto part shipment
- CUSMA origin certificates and supplier declarations that determine whether you pay 6.1% MFN duty or zero under preferential tariff treatment
- Commercial Accounting Declarations filed under Release 3 of CARM Phase 2, which tie directly to your financial security and monthly K84 statements
- Importer bond and RPP security account details, which CBSA uses to release shipments prior to final duty payment
A credential breach at the broker level does not just leak historical shipments. It opens the door to filing fraudulent entries under your importer number, draining your RPP security account, or triggering AMPS penalties that land on your business name. The 2024 CARM rollout centralized all of this in a single portal, which makes identity controls the only line between legitimate filings and fraud.
Canadian compliance gaps the Uber attack could exploit
CBSA does not pre-screen who picks up the phone at your broker's office. The agency validates that a CAD was filed by a licensed customs broker, but it does not verify that the person who logged into the CARM Client Portal to file it was actually authorized by the broker. If an attacker lifts broker credentials the same way Helix allegedly lifted Uber Freight's, they can file entries, manipulate origin claims, or request duty refunds without the importer knowing until the AMPS notice arrives.
The weaker link is often the importer's own identity controls. Most mid-market Canadian importers delegate CARM portal access to their licensed customs broker and never audit who at the brokerage actually has the login. If the broker uses shared credentials, or if a junior clerk's laptop is compromised, the exposure is identical to the Uber breach—just smaller scale and invisible until it is too late.
For automotive importers, the specific risk is CUSMA origin fraud. A bad actor with access to your supplier declarations and VIN-level invoices can fabricate a CUSMA certificate for non-originating parts, file a CAD claiming zero duty, and pocket the difference. CBSA runs verification audits, but those typically happen 12 to 24 months after the fact. By the time the agency issues a re-determination and assesses duties plus interest, the fraudulent filer is gone and the importer of record is left holding the liability.
What to ask your broker about data security and access controls
Most importers never ask how their broker stores customs data or who has portal access. After Uber Freight, that is the wrong posture. Here is what you should verify:
- Does the broker use individual logins for each employee who files CADs, or do multiple people share a single CARM Client Portal credential?
- How does the broker authenticate remote access, especially for employees working from home or traveling?
- Where are your origin certificates, supplier declarations, and VIN records stored, and are they encrypted at rest?
- If the broker's system is breached, how quickly will you be notified, and what is the kill-switch process to revoke CARM access?
These are not theoretical questions. The regulatory exposure for a fraudulent CAD filed under your importer number does not disappear just because someone else had the login. CBSA holds the importer of record liable for duties, penalties, and interest, regardless of who actually clicked submit.
If your auto parts shipments move through a sufferance warehouse before customs release, the data chain expands further. Warehouse operators hold cargo control documents, delivery orders, and often a copy of the CAD itself. A breach at the warehouse level can expose the same VIN and origin data. The tighter integration between freight, brokerage, and warehousing makes the attack surface larger, not smaller.
Closing the gap between digital customs and identity risk
The CARM system was supposed to modernize Canadian customs clearance by centralizing filings, financial security, and compliance in one portal. What it actually did was concentrate the fraud risk. A single compromised login can now access years of import history, modify pending entries, or drain your release prior to payment security. The Uber Freight breach is a reminder that the weakest authentication layer in logistics is not the government system—it is the third-party platforms and brokers who aggregate your data and access those systems on your behalf.
We run customs compliance audits that include identity access reviews, CARM delegation verification, and origin documentation trails. If you are moving automotive imports and your broker cannot answer the questions above, that is not a compliance gap—it is a liability you are already carrying.
Get in touch if your broker has never shown you their access control documentation. The next breach will not announce itself with a press release.
Frequently Asked Questions
What customs data does an auto import broker store for Canadian importers?
Licensed brokers retain VINs, purchase invoices, CUSMA origin certificates, supplier declarations, and Commercial Accounting Declarations for at least four years per CBSA record-keeping requirements under the Customs Act. For automotive imports, this includes production records and tariff classification decisions that determine whether you pay 6.1% MFN duty or claim zero-duty preferential treatment.
Can a fraudulent CAD be filed under my importer number without my knowledge?
Yes, if someone obtains your broker's CARM Client Portal credentials or your delegated access token. CBSA validates that a licensed broker filed the entry but doesn't verify the individual user's identity at login. The importer of record remains liable for duties and AMPS penalties even if the filing was unauthorized.
How long does it typically take CBSA to detect fraudulent CUSMA origin claims?
CBSA verification audits for CUSMA preferential claims typically occur 12 to 24 months after the original CAD was filed. By that time, the agency will issue a re-determination, assess the full MFN duty retroactively, and add interest plus potential AMPS penalties.
What is the MFN duty rate on passenger vehicles imported into Canada?
The most favored nation tariff on passenger vehicles under HS 8703 is 6.1%. Vehicles qualifying under CUSMA can enter duty-free if they meet regional value content and production rules. A fraudulent CUSMA claim can shift that 6.1% liability back to the importer years after clearance.
What is an RPP bond and why does it matter for auto imports?
Release Prior to Payment (RPP) is a financial security account that lets CBSA release your shipment before you pay duties and taxes. CBSA debits the account when your CAD is finalized, usually within five business days. If your broker's credentials are compromised, a fraudulent entry can drain your RPP security and trigger clearance holds on legitimate shipments.
What should I ask my broker about CARM portal access controls?
Verify whether the broker uses individual logins for each employee or shared credentials, how remote access is authenticated, where your origin certificates and VIN records are stored, and what the kill-switch process is to revoke CARM delegation if their system is breached. Most importers never audit this until after a data incident.
Originally published at https://www.canflow-global.com/en/insights/uber-freight-breach-puts-auto-import-broker-data-at-risk-what-canadian-importers/.
