Kaspersky Finds Warehouse Hack Via Barcode Scanners

In short: at the Security Analyst Summit 2026, Kaspersky researchers demonstrated a new attack vector against warehouse and retail networks — through ordinary wireless Bluetooth barcode scanners. The flaw: there's no mutual authentication between a scanner and its base station. An attacker intercepts the station's Bluetooth address, connects to it, and sends a malicious payload disguised as ordinary keystrokes. The station dutifully forwards them to the connected PC, which treats the attacker's input as a legitimate employee's — giving the attacker an initial foothold inside the warehouse network tied to critical IT systems. The flaw was found in hardware from several vendors; after the disclosure, Russian electronics retailer M.Video began its own internal review.

What the researchers found

Wireless barcode scanners are standard equipment in warehouses, stores, and pickup points: a cashier or picker scans an item and the data flies over Bluetooth to a base station wired to a PC or data-collection terminal. That convenience is exactly the weak point — Kaspersky researchers found that the communication protocol between the scanner and base station from several manufacturers requires no mutual device authentication. Any Bluetooth device in range that impersonates a 'legitimate' scanner is accepted by the station as genuine.

How the attack works

The exploitation chain has three steps. First, the attacker intercepts the Bluetooth address of an already-paired base station — being within range with suitable equipment is enough. Next, they establish their own connection to the station, mimicking a real scanner. Finally, they send the station a malicious payload disguised as ordinary keystrokes — the same way a scanner normally reports a scanned barcode number to the operating system. The station forwards those 'keystrokes' to the connected computer, which can't tell them apart from genuine device input: some of the characters turn into system commands, giving the attacker an entry point into the warehouse's internal network — the same network typically tied to inventory management, customer databases, and other critical IT processes.

Who's at risk

These scanners are most heavily deployed in retail and e-commerce — one of the most frequently attacked sectors: marketplace fulfillment centers, chain-store distribution warehouses, order pickup points. Following the disclosure, retailer M.Video began auditing its own equipment — a concrete sign the risk isn't theoretical and requires a real device inventory at every retailer. There's no immediate direct threat to shoppers themselves — the attack targets company infrastructure, not personal devices — but that same infrastructure is exactly where order, delivery-address, and payment data most often leaks from, the same pattern we covered in our piece on what everyday connected devices quietly collect about us: an 'invisible' communication channel in ordinary hardware becomes the leak point.

Is this like other Bluetooth attacks?

Yes — it's not the first time an under-secured Bluetooth channel has opened a path into a device or network. The same logic applies to wireless peripherals generally: we've covered how attackers can hijack a connection to ordinary Bluetooth headphones when a manufacturer skips proper device-to-device authentication. The difference is in the blast radius: a hacked pair of headphones threatens one person's privacy, while a hacked warehouse scanner is a potential launchpad against thousands of customer orders and a whole company's internal systems.

What to do

• Warehouse and store owners: inventory your fleet of wireless scanners and base stations, ask vendors whether their devices support mutual authentication and firmware updates, and segment the network so a scanner's base station has no direct path to critical databases.
• IT teams: monitor for unusual connections to Bluetooth base stations and log suspicious 'keystrokes' whose speed and pattern don't match a real scan.
• Warehouse staff: report scanner glitches or odd behavior on the connected PC — sometimes the first symptom of an attack isn't stolen data but simply nonsensical characters appearing on screen.
• Remote or mobile staff logging into warehouse-management systems from a café, airport, or hotel: use a VPN to encrypt the connection to work services — it doesn't fix the scanner flaw itself, but it reduces the risk of session interception on an untrusted public network. See the LiMP VPN features page and pricing.

Sources

• CNews — "A New Way to Attack Russian Online Stores and Warehouses Found" (October 20, 2026)
• RIA Novosti — "Kaspersky Identifies Vulnerabilities in Barcode Scanners" (October 20, 2026)
• Klerk.ru — "Hackers Could Gain Access to Marketplace Warehouse Management Systems"