Purpose of this paper To analysis the relationship between value (reported stolen value) and different incident categories in order to find patterns and trends in cargo theft within Europe. Design/methodology/approach The research is explorative as this type of research is missing in logistics but also deductive as it utilizes theories from criminology. The analysis is based on TAPA EMEA’s IIS transport related crime database. The result is analyzed and discussed within a frame of reference consisting of theories from logistics and criminology. Findings There are seasonal variations of incident categories. This variation is found both between months of the year and the day of the week for many of the incident categories, but the patterns are different for different incident categories. Within this understanding there are many changes in hot spots, modus operandi, theft endangered objects and handling methods during time, but the basic theoretical frame of reference is still more or less the same. Research limitations/implications The research is based on theories deduced from criminology and logistics together with secondary data regarding cargo theft. The geographically limitation to the Europe is done of practical reasons whiles the frame of reference can be used globally for analysis antagonistic threats against transports. Practical implications This research is limited by the content and classification within the TAPA EMEA IIS database. Nevertheless, this database is the best available database and the reports comes mainly from the industry itself, represented by the different TAPA members how report their losses anonymous, nevertheless the quality of the data limits the possibility to make normative statements about cargo theft prevention. What is original/value of paper This paper is the first within supply chain risk management that utilizes actual crime statistics reported by the industry itself, in order to analyze the occurrence of cargo theft by focusing on the value of the stolen vehicle/goods in relation with incident categories.