Recommended Free Tools
Blue Yonder confirmed that a ransomware incident disrupted its hosted managed-services environment on November 21, 2024. In December, the Termite ransomware group claimed responsibility and alleged it stole 680 GB of data—but Blue Yonder did not confirm the group’s attribution or the amount and contents of any stolen information. Its investigation was still ongoing in a December 9 statement.
What happened at Blue Yonder?
Blue Yonder, a supply-chain software provider, said outages began in its hosted managed-services environment on November 21, 2024, and that it determined they resulted from a ransomware incident. INCIBE-CERT, Spain’s national cybersecurity institute, described Blue Yonder as serving more than 3,000 large companies; that figure describes its customer base, not the number affected by this incident. INCIBE-CERT’s incident summary reported the outage and the company’s determination.
What did Termite claim, and what did Blue Yonder confirm?
In reporting published December 9, 2024, TechCrunch and CyberScoop said the group known as Termite claimed responsibility. The group alleged that it had exfiltrated 680 GB of data; CyberScoop also reported Termite’s claim that the material included more than 200,000 insurance documents. These are the group’s allegations, not verified quantities or contents. TechCrunch’s report said Blue Yonder declined to specify how much or what types of data had been taken and did not dispute the 680 GB claim when asked. CyberScoop’s report covered the group’s claims.
Blue Yonder spokesperson Marina Renneke told TechCrunch: “We are aware that an unauthorized third party claims to have taken certain information from our systems.” She added: “We are working diligently with external cybersecurity experts to address these claims. The investigation remains ongoing.” The statement acknowledged a theft claim and an ongoing investigation; it did not publicly identify Termite as the attacker or confirm that the alleged data had been taken.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
How did the outage affect Starbucks, Morrisons and Sainsbury’s?
The reported disruption affected specific operations that relied on Blue Yonder services; it does not establish that all operations at these retailers, or all Blue Yonder customers, were affected.
- Starbucks: The disruption affected employee scheduling and hours tracking. Starbucks said customer service was not affected. The Associated Press reported that Starbucks was able to process payroll again by November 26, 2024.
- Morrisons: The disruption affected warehouse management for fresh and produce. The AP reported the retailer was using workarounds.
- Sainsbury’s: The AP reported that service had been restored by November 26.
The Associated Press’s November 26 report described these operational effects and recovery steps.
Rank #2
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
What remained unknown in the contemporaneous reporting?
Blue Yonder’s December 9 statement said its investigation was ongoing. The cited contemporaneous reports did not establish the total number of affected Blue Yonder customers, whether the alleged 680 GB was actually exfiltrated, or the verified amount and types of any stolen data. They also did not establish whether a ransom was demanded or paid. A group’s claim of responsibility is not, by itself, independent proof of attribution.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Was the attack connected to the Cleo vulnerability?
No connection was established in the cited reporting. In a December 27, 2024 report, Blue Yonder said it had no reason to believe a separate Cleo vulnerability matter was connected to the November ransomware incident. The Record’s report covered the company’s statement. The two matters should be treated as separate unless evidence establishes otherwise.
Quick Recap
Best Value
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Rank #4
- SonicWall Advanced Protection Service Suite for NSA3700 - 3 Year License (02-SSC-6910)
- Capture ATP with RTDMI for Enterprise: Defend against zero-day exploits and ransomware using multi-engine cloud sandboxing and advanced memory inspection.
- Full Threat Protection Stack: Includes Gateway AV, Intrusion Prevention, Anti-Spyware, Application Control, and Content Filtering for layered defense.
- 24x7 Global Support & Firmware Updates: Keep your firewall protected and operational with continuous technical assistance and critical firmware upgrades.
- Application Intelligence & Network Control: Identify and control network activity with deep traffic analytics and reporting features.
Rank #3
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
Incident timeline
- November 21, 2024: Blue Yonder experienced outages in its hosted managed-services environment and determined they resulted from a ransomware incident.
- November 26, 2024: The AP reported workarounds at Starbucks and Morrisons, Starbucks payroll processing restored, and Sainsbury’s service restored.
- December 6–9, 2024: Termite claimed responsibility and alleged data theft; Blue Yonder acknowledged that an unauthorized third party had made a claim and said its investigation was ongoing.
- December 27, 2024: Blue Yonder said it had no reason to believe the separate Cleo matter was connected.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
