Blue Yonder suffers ransomware attack affecting clients such as Starbucks

What happened

A ransomware attack against Blue Yonder, a supply-chain technology provider, caused disruption at several client companies starting on 26 November 2024. Starbucks turned to manual procedures for some of its processes, and British retail chains activated contingency measures.

The incident affected these companies' ability to manage inventory, staff scheduling and other supply-chain functions that relied on Blue Yonder's cloud-hosted systems.

What it means for a mid-sized business

Third-party cybersecurity is part of your own security. When an external provider manages critical functions such as supply-chain operations, an incident on its infrastructure directly translates into business disruption, even if the company's own internal systems were never compromised.

The case also shows that large, well-resourced companies such as Starbucks had to fall back on manual processes, confirming that no organisation is exempt from depending on an external provider for essential functions.

What to review

Steps to reduce the impact of an incident at a critical provider:

• A list of critical providers and which business function each supports.
• The recovery times each provider commits to in case of an incident.
• Alternative manual procedures for the most critical functions.
• Integrations and data that depend on each provider, and their exposure.

Frequently Asked Questions

What kind of service does Blue Yonder provide?

Supply-chain management software used by retail and other companies for inventory, logistics and planning.

How did it affect Starbucks?

The company had to fall back on manual procedures for some processes while the incident at Blue Yonder was resolved.

How can a mid-sized business protect itself from this risk?

By identifying its critical providers, requiring information about their continuity plans and defining alternative manual procedures.