Managed hosted services disrupted
Blue Yonder said a ransomware incident disrupted its managed services hosted environment Nov. 21, 2024. Its original incident updates describe outside cybersecurity assistance, defensive measures and restoration work.
The company initially had no restoration timetable. It said it was monitoring its Azure public-cloud environment and had not seen suspicious activity there at that time. That statement did not establish that every Blue Yonder environment or customer was affected.
Downstream workforce disruption at Starbucks
Starbucks’ employee scheduling and hours-tracking platform was disrupted, requiring manual tracking so employees could be paid. Cybersecurity Dive reported Dec. 12 that Starbucks had confirmed the platform was back in service the previous day.
Starbucks said its Blue Yonder connection had been disconnected, rather than describing direct attacker access to Starbucks systems. It planned continued checks on pay accuracy. The operational disruption does not establish theft of Starbucks employee information or closure of its stores.
Pen maker BIC reported limited shipping delays on Nov. 27. Its spokesperson said the outage did not directly affect its operations. That statement does not establish a BIC factory shutdown.
Recovery remained staged
Blue Yonder’s Dec. 1 update said several affected customers were back online while others were still being restored. By Dec. 12, it said a significant majority had service restored and work with affected customers continued.
These milestones do not identify an exact date when every customer’s service returned. Later archival capture dates also do not extend the duration of an outage described in an earlier update.
Claims and separate investigations
The Record reported Dec. 6 that Termite claimed responsibility and alleged theft of 680 gigabytes. Blue Yonder acknowledged an unauthorized party’s claim and said it was investigating; it did not independently confirm that volume in the reviewed update.
Later Clop claims concerning Cleo file-transfer software are a separate reported matter. Blue Yonder said it had no reason to connect that vulnerability with the November incident. Neither claim establishes a verified ransom payment or personal-information victim count for this outage.
Later business consequences
In an Oct. 30, 2025, investor presentation, Panasonic linked higher Blue Yonder customer churn and slower annual recurring revenue growth to the cyberattack. It described security investments and customer follow-up. These business consequences do not establish that the original service outage continued into 2025.
Current assessment
The incident is presumed resolved because the last directly verified restoration work was documented Dec. 12, 2024. The reviewed sources do not establish an exact end date for all affected customers. Later theft claims and investigations do not extend the documented operational disruption.
