Major UK retailers impacted by Blue Yonder security breach

Blue Yonder, a Panasonic subsidiary renowned for its AI-driven supply chain solutions, recently suffered a ransomware attack that caused substantial disruptions to its services. The incident, which occurred on November 21, 2024, affected the company’s managed services hosting environment, resulting in outages across its cloud-hosted solutions and SaaS platforms.

The company has assured stakeholders that its public Azure cloud environment remains secure, with no suspicious activity detected.

The ransomware attack directly affected Blue Yonder’s extensive customer base, which includes over 3,000 organisations. Among those affected were major UK supermarket chains such as Morrisons and Sainsbury’s. Morrisons reported product availability in certain locations dropping to as low as 60%, forcing the retailer to rely on slower backup processes.

Sainsbury’s, meanwhile, activated contingency measures to manage the fallout. In the US, Starbucks encountered back-end disruptions related to employee scheduling and time-tracking, though no widespread issues have been reported.

 

Blue Yonder is working to address the attack and provide ongoing client updates.

 

Blue Yonder, which supports 46 of the top 100 manufacturers, 64 of the top 100 consumer goods companies, and 76 of the top 100 global retailers, is working with external cybersecurity firms to mitigate the impact of the attack. The company has implemented defensive and forensic measures to address the breach but has not provided a timeline for full restoration. Updates are being shared with clients through a dedicated customer page, although progress remains ongoing.

The attack highlights the vulnerabilities of supply chain systems, especially during high-demand periods like the holiday season. Similar incidents, such as attacks on Kaseya and MOVEit, underscore the risks posed by targeting a single, trusted software provider.

A recent study found that 86% of ransomware attacks in the past year occurred during holidays or weekends, exploiting reduced IT staffing. Up to 85% of surveyed organisations reported scaling back their security operations centres during these times, with some reducing staff by as much as 50%.

Experts stress the importance of maintaining robust cybersecurity measures throughout the year. User training, regular backups, and tested disaster recovery plans are key defences against such incidents. Cybersecurity professionals also recommend maintaining at least 75% of standard staffing levels during holidays to ensure operational resilience.

The Blue Yonder incident reminds organisations to remain vigilant and prepared against cyber threats, especially during periods when defences are often weakened.