Ransomware Attack on Supply Chain Provider Causes Disruption

Major grocery store chains, Starbucks and other large organizations are experiencing disruptions following a ransomware attack against a key supply chain management software provider.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

The affected service provider, Blue Yonder, first warned customers about the attack on Friday, reporting that the prior day it began experiencing “disruptions to its managed services hosted environment, which was determined to be the result of a ransomware incident.”

Known until 2020 as JDA Software and acquired by Panasonic in 2021, Blue Yonder is an independently operated software supplier and consultancy based in Scottsdale, Arizona, that provides supply chain management products and services to businesses. The company’s offerings include inventory management and distribution systems, as well as generative artificial intelligence tools designed to streamline existing supply chains.

In a series of breach updates, the company said its response team “is working around the clock to respond to this incident and continues to make progress,” but offered no timeline for when services might be restored.

“Since learning of the incident, the Blue Yonder team has been working diligently together with external cybersecurity firms to make progress in their recovery process. We have implemented several defensive and forensic protocols,” it said. “The experts along with the Blue Yonder team are working on multiple recovery strategies and the investigation is ongoing. At this point in time, we do not have a timeline for restoration.”

The company said its investigation to date has found that the Blue Yonder Azure public cloud environment didn’t appear to have been breached by attackers.

One of the organizations affected by the outage is Starbucks, which said the outage has disrupted its ability to track the hours worked by its baristas across its 11,000 North American stores, as The Wall Street Journal first reported.

Starbucks told the newspaper the outage hasn’t affected its ability to serve customers, but that it will need to reconcile hours for which baristas – which it calls partners – were scheduled to work, versus their actual hours, which might be more or less, meaning they could be overpaid or underpaid. “Keeping our partners whole despite the outage continues to be our priority, and we’re ensuring they will receive pay for all hours worked,” Starbucks said.

Two of Britain’s “big four” grocery retail chains, Morrison’s and Sainsbury’s, also have reported their operations being affected by the Blue Yonder service outage.

Sainsbury’s, which counts 600 supermarkets and over 800 convenience stores, and which also owns consumer goods retailer Argos, said its operations have been affected and it has “contingency processes in place.”

Morrisons, which operates 500 stores across England, Wales and Scotland, also confirmed being disrupted. “Last week Blue Yonder suffered an outage which has impacted our warehouse management systems for fresh and produce,” Morrisons told Information Security Media Group in a statement. “Ambient and frozen are unaffected. We are currently operating on our back-up systems and we’re working very hard to deliver for our customers across the country.”

The disruptions are occurring ahead of Black Friday on Nov. 29, an annual marketing event tied to sales timed for the day after the Thanksgiving holiday in the United States, although many retailers in the U.S. and abroad begin their respective promotions earlier.

Blue Yonder hasn’t detailed which of its customers are affected by the outage, and the company didn’t immediately respond to a request for comment. The company’s website says its customers also include BJ’s Wholesale Club, Crate & Barrel, PepsiCo’s Latin America business, Unilever Brazil, Kmart Australia and the U.S. Agency for International Development, aka USAID. Other customers include the two largest supermarket operators in the U.S.: Kroger, which runs such brands as Ralphs, Dillons, Smith’s and Fred Meyer; and Albertsons, which also operates stores under a number of other brands, including Safeway, Jewel-Osco and Shaw’s.