Dive Brief:
- Morrisons, the U.K. supermarket chain, has restored normal operations following the November ransomware attack against Blue Yonder, which disrupted logistics and inventory management at numerous retailers, supermarkets and manufacturers across the globe.
- Morrisons, which has about 500 stores across the U.K., said last month the cyberattack led to an outage that impacted its warehouse management system for fresh food and produce. The company says those issues are now resolved.
- The spokesperson confirmed the hackers did not gain access to Morrisons IT network nor was any customer data under threat. "We have recovered from the Blue Yonder outage quickly and our back up system is working well,” a Morrisons spokesperson said via email.
Dive Insight:
Arizona-based Blue Yonder was hit by a ransomware attack on Nov. 21, just days before the Thanksgiving holiday weekend in the U.S.
Blue Yonder, which was acquired by Panasonic in 2021, provides supply chain management software that helps companies forecast sales, manage store inventories and automate additional logistics.
The company’s managed services hosted environment was impacted by the attack. The company has been working with external forensic experts to investigate the impact and said it has taken steps to harden its network environment.
A new threat group called Termite ransomware claimed credit for the attack in a posting on a dark web leak site, researchers at Arctic Wolf told Cybersecurity Dive. The group, which just launched the leak site in October, claims to have 680GB of Blue Yonder data.
Researchers from Broadcom say Termite appears to use a modified version of Babuk ransomware and have previously claimed victims in Canada, France, Germany and the U.S. among others.
Blue Yonder said on Sunday it was making progress towards a full recovery and was actively working with customers to help them restore normal operations.
Starbucks, another major customer of Blue Yonder, said the attack impacted a scheduling platform used by baristas to keep track of their hours worked, but service was otherwise normal.
The international coffee house chain was working to make sure workers did not have their paychecks delayed. It has not provided an update since last week on restoration efforts.
