Many shipping companies (like DHL, UPS, national postal services, etc) will allow the recipient of a package to track their package online, and will often display the address that the package is being delivered to before it has been delivered, and/or the "proof of delivery" with the address of where it was delivered to and who signed for the package. However, this publicly presents the delivery information for every package, and an attacker simply needs to scrape that data.
Is this considered dangerous? Has there been any reported/documented "attacks" on shippers or recipients performed by exploiting the delivery information presented by couriers?
This thought came to my attention due to an article about how 4,500 marijuana purchasers had their addresses stolen. Basically, people purchased marijuana legally online from a Canadian government website (the Ontario Cannabis Store, or OCS), but an attacker was able to use a Canada Post "tracking tool" to get the delivery information for those shipments. It doesn't explain how the attacker did it, but it's not hard to come up with at least one possible method:
Canada Post (and many other courier companies around the world) allow a shipper to provide a "reference number" with their shipments, which many shippers use as a place to store an identifier, such as the order number, for the shipment. Both the shipper and the recipient can use this reference number for tracking, rather than using the tracking number generated by the shipping company. So what this attacker may have done, was received a package from OCS, noted the reference number and figured out a pattern (eg "OCS" followed by 6 digits), then brute forced the Canada Post tracking tool to try and find a bunch of packages that match (even easier to do if the reference number was an incrementing order number). From there, they were able to get the delivery address and signature of marijuana recipients.
This particular attack was a privacy breach, but it's not hard to see this used for things like corporate espionage (if you can figure out your competitor's reference number patterns, you can start monitoring their shipments and observe who their clients are), or even theft. For example, if you live in a large city, you could find a reference number pattern for a large retailer (say, from an Amazon distribution centre), and monitor all of their shipments. Once you find a shipment destined for your city, you just monitor the tracking to see if it ended up being left in a "safe" place (eg "by the side door"), or if it was signed for by a human...And if it wasn't signed for by a human, the attacker has an address that they can just go steal the package from.
You could, of course, do many other things, like redirect a package to a different address (many companies only require the tracking number and verification of the original destination address, which can be gathered from tracking), or be used to glean information for social engineering. But I'm not trying to create an exhaustive list; I'm basically just asking if this is viewed as an attack vector by any industries (shipping companies or pen testers), and/or if it is commonly targetted. Displaying the destination address and/or the "proof of delivery" seems to be industry standard, and I don't know if this is simply a case of "user convenience" outweighing the potential risk, or if companies just don't consider it dangerous to present this information publicly.