On December 4, a hacker forced open 2,732 package lockers across Moscow operated by local delivery service PickPoint using an unidentified exploit
Context & Ripple Effects
PickPoint's Moscow locker network was opened wholesale by a single unidentified exploit — one flaw, 2,732 doors — which puts it in the same family of unauthenticated remote attacks as the zero-day Microsoft patched after Russian hackers exploited an Outlook flaw requiring no user interaction.
The incident also echoes the region's history of attacks that reach past software into physical operations: Kaspersky documented hackers planting hardware inside eight Eastern European banks, and LockBit's hit on Royal Mail customs label printers showed how a narrow technical foothold can halt a national postal flow. Parcel lockers sit at that same junction of code and physical goods.
First-order effects
- PickPoint must identify and patch the exploit across its entire locker fleet while securing already-opened compartments — every unit running the vulnerable software is exposed until remediated.
Second-order effects
- Other locker and last-mile delivery operators now face customer and partner pressure to audit their own locker-management software, since a single-vendor exploit demonstrated fleet-wide physical access rather than isolated break-ins.
Third-order effects
- If parcel-locker networks keep consolidating as shared last-mile infrastructure, they become a recognized target class like postal systems — where one vulnerability scales from a data breach to disruption of physical goods movement.
The trend: Last-mile logistics infrastructure is shifting from an overlooked attack surface to a strategic one, where a single software flaw translates directly into physical access at scale.