Blue Yonder: the supplier ransomware that stopped retail warehouses

On 21 November 2024 ransomware hit Blue Yonder's managed environment, stopping staff pay at Starbucks and fresh-food warehouses at Morrisons. The analysis: dependent business interruption, perishable stock, retail aggregation and questions for renewals.

Archive: reconstruction written in November 2026

Topic of the month, November 2024 · by cybercoverinsurance

On 21 November 2024 Blue Yonder, one of the largest supply chain software providers, suffered a ransomware attack on its managed services environment. In the following days Starbucks had to pay staff in thousands of stores by hand, Morrisons lost the warehouse management system for its fresh products and Sainsbury's activated contingency processes. None of the customers had been breached.

The case came a few months after Change Healthcare and CDK Global, and confirmed the 2024 pattern. The widest damage from ransomware is not at the company hit, but at the customers that depend on its hosted services. For cyber underwriters, Blue Yonder is a test of dependent business interruption cover and of aggregation in retail, at a time of year when every day of downtime weighs more.

What is known

The attack. Blue Yonder said on 21 November 2024 that its managed services hosted environment had been disrupted, later traced to ransomware (CyberScoop). The company, based in Arizona and owned by Panasonic, has more than 3,000 customers among manufacturers, distributors and logistics operators (BleepingComputer). Its Azure public cloud environment was not affected (Cybersecurity Dive).

The customers hit. Starbucks reported an impact on about 11,000 stores in North America, in staff scheduling and pay, with no effect on customer service. Morrisons lost warehouse systems for fresh food and produce, while ambient and frozen were not affected, and ran on backup systems. Sainsbury's activated contingency processes to protect supply. Tesco and DHL said they were not affected (ITPro). BIC reported shipping delays (BleepingComputer).

Recovery. On 1 December Blue Yonder said several customers were back online (Cybersecurity Dive). On 6 December Morrisons said it had restored normal operations and that its own network had not been breached (Cybersecurity Dive). Blue Yonder did not disclose how many customers were affected.

The claim. The Termite group, which appeared in mid-October 2024, claimed the attack and said it had stolen 680 GB of data, including more than 16,000 email addresses and more than 200,000 documents. Termite uses a version of the Babuk code, leaked publicly in 2021. Blue Yonder said it was investigating the claim (BleepingComputer). In January 2025 the Clop group listed Blue Yonder among about 60 companies hit through vulnerabilities in Cleo file transfer software. Blue Yonder confirmed it uses Cleo and said it was investigating. No link to the November attack has been reported (Cybersecurity Dive).

What is not known. The access vector, any ransom payment and the cost to Blue Yonder and its customers have not been made public.

The damage is at the customers

No customer was breached, many stopped. Morrisons said its own network had not been touched. The damage came from the hosted service its warehouses depended on. It is the same pattern as Change Healthcare in healthcare and CDK Global for car dealers: a software-as-a-service provider becomes the breaking point of a whole sector.

The outage came at the worst time. The attack happened a few days before US Thanksgiving and at the start of the Christmas season in the UK (Cybersecurity Dive). For a fresh food distributor, even a few days of manual warehouse management can mean expired stock, empty shelves and lost sales.

Customers' costs are mostly extra expense. Pay calculated by hand, extra warehouse staff, backup systems. These are real costs, often easier to document than lost margin, but many policies cover them only within sublimits.

Which cover responds

Dependent business interruption is the key cover. Blue Yonder's customers can only trigger dependent business interruption, if they bought it. Many policies limit it to IT suppliers, and Blue Yonder fits that definition, but with sublimits often far below the main limit.

The waiting period decides the claim. A waiting period of 8, 12 or 24 hours, common in cyber policies, matters little for a two-week outage. But customers back in operation within days, thanks to backup systems, may stay below the threshold or just above it. In that case the real cost stays with the insured.

Loss of perishable stock is a grey area. Fresh products thrown away because of a warehouse error caused by a cyber attack: physical damage or interruption loss? Cyber policies usually exclude physical damage to property, and property policies often exclude cyber events. It is an area to clarify in food retail wordings.

The supplier's data theft opens a second strand. If the data taken by Termite includes information on Blue Yonder's customers, those customers may have notification duties of their own. It is a cost that arises from someone else's incident, and the customer's policy must cover it as a breach at a third party.

Aggregation in retail

More than 3,000 customers, one environment. Blue Yonder serves manufacturers, grocery chains and logistics operators. An insurer with a large retail book may have dozens of insureds depending on the same service. One event produces correlated dependent interruption claims, in the same period and the same region.

Concentration is known only to those who ask. Blue Yonder's customers were not a public list. Only some of the affected customers spoke. Without a specific question in the underwriting questionnaire, the insurer discovers the dependency at claim time.

2024 showed a series, not an isolated case. Change Healthcare in February, CDK Global in June (TechTarget), Blue Yonder in November. In each case a hosted software provider for a specific sector stopped thousands of customers. For a portfolio, these vertical providers are an aggregation distinct from the large clouds, and often less mapped.

What to bring to renewals

Impact for insurersHigh

A single supply chain software provider stopped critical processes at several grocery chains at the same time, in peak season.

On the portfolio side, the useful work is a list of the vertical software providers used by insureds in each sector: supply chain for retail, dealer management for car dealers, payment intermediaries for healthcare. Each is a potential event with many claims at once, and should be treated as a loss scenario of its own.