Blue Yonder put process-running vendors at the top of the risk register
The Blue Yonder ransomware attack disrupted staff scheduling and pay at major retailers. Vendor risk programs built around data protection miss suppliers whose failure stops work, and classifying vendors by what their failure costs changes diligence, contracts and contingency spending.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On November 21, 2024, Blue Yonder, a supply chain software company owned by Panasonic, disclosed that a ransomware attack had disrupted its managed services hosted environment. Over the following days customers described the effects. Starbucks said the outage hit the back-end system it used to manage barista schedules and pay, and that it was working to make sure staff were paid correctly. The British supermarket chains Morrisons and Sainsbury’s reported disruption to warehouse or scheduling systems. The attack drew wide coverage during U.S. Thanksgiving week. In December the Termite ransomware group claimed responsibility and said it had taken data. The incident followed two larger 2024 outages of the same kind: the February attack on Change Healthcare, which stalled claims and payments for providers nationwide, and the June attack on CDK Global, which disrupted thousands of car dealerships.
Vendor risk programs at banks, health systems and agencies are usually organized around data. Their questionnaires ask what sensitive information a vendor holds, how it is protected and how fast a breach will be reported. Those questions matter. Blue Yonder, following Change Healthcare and CDK Global earlier in 2024, showed what they miss. A vendor that runs a business process can stop that process, and no organization can buy a replacement scheduling, claims or core platform within a week.
A better register sorts suppliers by what the organization loses if the vendor fails. There are three possibilities, and every supplier falls into one: data custodians, whose failure exposes information; process operators, whose failure stops work; and commodity suppliers, whose failure costs money but can be fixed by switching. Process operators also hold data, so they inherit every data control. What separates them is that availability, not confidentiality, sets their risk.
Data custodians: exposure without stoppage
Data custodians hold sensitive information but do not run critical day-to-day work. Archiving services, analytics platforms, survey tools and some marketing systems fit here. A breach brings notification duties, regulatory inquiries and reputational harm. An outage is an inconvenience.
Most vendor programs are built for this category, and questionnaires, attestations and contract terms on breach notification handle it reasonably well. The usual gap is scope creep. Custodians accumulate more data than the original contract contemplated, as teams upload extracts for one-off projects and never delete them. An annual data inventory per custodian, with deletion of anything outside the contracted purpose, is the improvement that matters most.
Process operators: stoppage the organization cannot buy its way out of
Process operators run workflows the organization depends on: workforce scheduling and payroll, claims processing, core banking, electronic health records, benefits eligibility and permitting. For Blue Yonder’s customers the immediate problem was operational. Schedules, pay calculations and warehouse work could not run normally.
This category needs a different set of questions. How long can we operate without the vendor, measured in days? What is the manual fallback, and when was it last exercised? Do we receive a recent export of our own data, in a format we can use without the vendor’s software? How fast has the vendor actually restored service in tests, and can we see the results? What happens to pay, patient care or public services in the meantime?
The answers should drive contract terms. Useful clauses start with restoration time commitments matched to the organization’s real tolerance. Add scheduled data exports delivered to storage the organization controls, rights to see recovery test results, and notice within hours of a disruption. Finally, allocate the extra costs of manual operation during an outage. These terms cost money or negotiating effort, which is why they belong only in process-operator contracts.
Concentration adds a second-order risk. When one hosted environment serves many customers, an attack hits all of them at once and the vendor’s recovery teams are stretched. Organizations should ask how many customers share their environment and how the vendor decides restoration order. Large customers often find they are not first.
The economics of this category also change the budget conversation. Spending on a process operator’s resilience is usually split across procurement, IT and the business owner, so nobody sees the whole cost or the whole risk. A useful discipline is to price one week of outage for each process operator, covering overtime, manual processing, delayed revenue and penalties, and set that figure beside the annual contract value. Where the outage cost dwarfs the contract, paying more for stronger terms or a warm standby is easy to justify.
Payroll deserves particular attention because the harm lands on employees within days. Starbucks’ first public concern was paying baristas correctly. A health system or agency that cannot run payroll faces staff hardship, possible wage-law exposure and, quickly, staffing gaps in care or services. Preparation is modest: retain the last few pay registers locally, agree a method for paying staff an estimate and reconciling later, and pre-draft the message to employees. The December 2021 ransomware attack on a cloud workforce management service had already shown employers, including hospitals and local governments, why this matters.
Commodity suppliers: replaceable by design
Some suppliers provide services that can be switched quickly, at a cost: office supplies, standard software licenses, some communications tools. They warrant light oversight, which frees attention and budget for the other two groups.
The catch is drift. A tool bought as a commodity can become a process operator once teams build workflows on top of it. A form builder becomes the intake system for a benefit program; a ticketing tool becomes the route for clinical equipment requests. Reclassification should be triggered by usage, not by renewal dates. A simple prompt in the annual vendor review, asking business owners what would stop if the tool vanished tomorrow, catches most of it.
With hindsight
Blue Yonder restored services for affected customers over the following weeks, and the incident joined a run of attacks on software providers that spread from one vendor to many customers. In January 2025 the EU’s Digital Operational Resilience Act took effect for financial entities, with its focus on ICT third-party concentration, which a later article in this series examines. The pattern recurred outside finance. In September 2025 a ransomware attack on Collins Aerospace’s passenger processing software disrupted check-in and boarding at several European airports, including Heathrow, Brussels and Berlin. That was another process operator shared by many customers, with manual fallback carrying the load. The distinction between data risk and process risk has been easier to see in incident reports than in vendor questionnaires, which in many organizations still lead with data protection.