Kaspersky Analysis Maps Warehouse Cyber Risks and Physical Consequences

Kaspersky Securelist researchers have published an analysis detailing the security vulnerabilities inherent in modern warehouse environments. The report explains how initial access vectors specific to these facilities can lead to significant operational disruptions. According to the researchers, modern warehouses function as tightly interconnected hybrid systems where physical processes depend entirely on data integrity.

The publication breaks down the initial access vectors that threat actors use to compromise warehouse management systems. It discusses the cascading impact of such compromises on logistics processes. Errors in data within these systems result in very physical consequences, such as stopped conveyors and blocked cargo. The researchers emphasize that a cyber incident at this scale becomes a problem for the entire business.

Operational Vulnerabilities and Recent Incidents

The report highlights several recent examples of cyber incidents affecting major logistics and retail companies. An outage previously affected warehouse management systems at the grocery giant Morrisons. United Natural Foods, Inc. confirmed unauthorized activity on its information technology systems in its 2025 Form 10-K annual report, which impacted order fulfillment. More recently, reports emerged that a cyberattack disrupted eight CEVA Logistics warehouses across Europe and exposed customer delivery data.

These incidents demonstrate how digital failures translate into physical operational halts. Packages may head to wrong cities, and websites might show items in stock when bins are empty. Trucks line up at gates while cargo piles up without freight manifests. Every minute of downtime results in blown schedules, support tickets, fines, and lost sales. The divergence between physical inventory and digital records is inherited by all subsequent processes.

The Journey of an Order

The analysis follows a single order through eight main stages to show where operations are vulnerable. At the unloading stage, digital commands trigger physical actions, such as assigning truck gates via tablets or outdoor displays. Incorrectly assigned gates can create queues or send goods into the wrong workflow. During receiving, employees scan barcodes using portable data terminals, creating a digital record that must match the physical box.

In the putaway stage, goods move to internal storage using thermal printers connected via Wi-Fi and lifts controlled by programmable logic controllers. An employee, forklift, or automated system moves goods to assigned bins. If the digital record and physical object diverge at any point, the error persists. The threat model outlines what is at risk, who can access it, and how each risk lands on the business.

What should you do?

Security professionals should review the initial access vectors specific to warehouse environments identified in the Kaspersky report. Organizations must ensure that digital records in warehouse management systems accurately reflect physical inventory at every stage. Monitoring for unauthorized activity on information technology systems that impact order fulfillment is critical.

What to do and how to stay safe: Kaspersky

• Audit initial access vectors specific to warehouse environments to identify potential entry points for threat actors.
• Verify that digital records in warehouse management systems match physical inventory during receiving and putaway stages.
• Monitor warehouse management systems for unauthorized activity that could impact order fulfillment and data integrity.
• Review controls at each of the eight main stages of the warehouse process to ensure physical and digital alignment.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which companies have recently experienced warehouse cyber incidents?

Morrisons, United Natural Foods, Inc., and CEVA Logistics have experienced disruptions or unauthorized activity affecting their warehouse operations.

What are the physical consequences of a warehouse cyber incident?

Consequences include stopped conveyors, boxes stuck between floors, trucks lining up at gates, and packages heading to wrong cities.

How does a digital error propagate in a warehouse?

If the digital record and physical object diverge during receiving, the error is inherited by all subsequent processes in the warehouse.