Blue Yonder said most customers have restored normal operations following a pre-Thanksgiving ransomware attack, however it will continue to work with others to get their platform back up and running. 

“A significant majority of our impacted customers have had their service restored,” a spokesperson for Blue Yonder told Cybersecurity Dive via email. “Our associates continue to work closely with our impacted customers on the restoration process and keep them updated as appropriate.”

The company is still investigating the Nov. 21 intrusion, which a group called Termite ransomware has claimed credit for on a leak site. Blue Yonder said it was aware of the claim and is working with law enforcement and external forensic experts to further investigate the attack. 

Starbucks on Wednesday confirmed that an employee scheduling platform backed by Blue Yonder technology was back in service. The coffee chain had to manually track barista hours to make sure employees were paid on time when the ransomware attack at Blue Yonder disrupted its operations.

Starbucks plans to remain vigilant over the next few weeks to make sure workers are paid accurately, according to a spokesperson. The company has not detailed exactly what happened during the attack, however it said the connections to Blue Yonder technology was disconnected during the attack as opposed to the hackers gaining direct access to Starbucks systems.

Blue Yonder provides supply chain technology to thousands of customers globally, including retailers, supermarket chains, logistics companies, manufacturers and others. Last week, U.K. supermarket chain Morrisons confirmed that services were restored after the company’s warehouse management system for fresh food and produce was disrupted during the attack.