Blue Yonder put process-running vendors at the top of the risk register

The week

On November 21, 2024, Blue Yonder, a supply chain software company owned by Panasonic, experienced a disruption to its managed services hosted environment that it confirmed was a ransomware incident. Thanksgiving was a week away. The effects became public news over the following days, during Thanksgiving week itself, usually a slow one for corporate technology teams.

Blue Yonder is not a household name. The Arizona-based company, formerly known as JDA Software, sells software for demand forecasting, warehouse management, transportation planning and workforce scheduling. Panasonic completed its acquisition of the company in 2021. TechCrunch reported that it had more than 3,000 customers, with DHL, Starbucks and Walgreens among the names it listed. How many of those customers ran on the affected hosted environment was never made public.

Two terms are worth unpacking. Ransomware is malicious software that criminals slip into a network to lock up files and systems, usually by scrambling them with encryption. The owner cannot use them until a ransom is paid or the systems are rebuilt from backups. Many gangs now also copy data before locking it, so they can threaten to publish it. A managed services hosted environment means the vendor runs the software it licenses on its own computers, on customers’ behalf, and keeps it working. Customers log in over the internet. That convenience has a catch: when the vendor’s environment goes down, every customer on it goes down too.

Over the following days customers described what that looked like. Starbucks said the outage hit the back-end system it used to manage barista schedules and pay, and that it was working to make sure staff were paid correctly. In Britain, the supermarket chains Morrisons and Sainsbury’s reported disruption to warehouse or scheduling systems. These companies had not been attacked directly. Their supplier had.

The details that emerged over the next two weeks showed how varied the damage was. Starbucks said its connections to Blue Yonder had been cut during the attack and that the attackers had not reached its own systems. Its store managers tracked barista hours by hand so that people would be paid on time. Morrisons said the attack had disrupted its warehouse management system for fresh food and produce, and reported that service was restored in early December. The affected customers did not need to rebuild their own networks. They needed to keep working while someone else rebuilt theirs.

The timing made it news. The attack drew wide coverage during U.S. Thanksgiving week, when retailers are at their busiest and staffing matters most. In December the story took another turn when the Termite ransomware group claimed responsibility and said it had taken data. That added a possible data exposure to an incident that had so far been about systems that would not run.

According to TechCrunch, Termite posted the claim on its leak site and said it had taken 680 gigabytes of data, including documents, reports, insurance documents and email lists. Blue Yonder said it was aware that an unauthorized third party claimed to have taken certain information and that its investigation was continuing. It did not dispute the claim. Security researchers cited in the same coverage believed Termite was a rebrand of Babuk, a Russia-linked ransomware operation that the U.S. Department of Justice had tied to more than 65 attacks. By December 12, Blue Yonder said a significant majority of affected customers had their service restored.

For anyone watching the year closely, the shape was familiar. In February, an attack on Change Healthcare had stalled claims and payments for health care providers nationwide. In June, an attack on CDK Global, which supplies software to car dealers, had disrupted thousands of dealerships. UnitedHealth Group, which owns Change Healthcare, later confirmed that it had paid a ransom. CDK had been hit by the BlackSuit group and restored dealers over roughly two weeks, while many dealerships went back to paper deal jackets and manual title work. Blue Yonder was the third large 2024 outage of the same kind: one software provider hit, many customers unable to do ordinary work. Each time, the organizations that suffered most had done nothing wrong themselves except depend on a supplier they could not quickly replace.

A fourth episode, months earlier, was different in cause but similar in shape. On July 19, 2024, a faulty content update from CrowdStrike crashed Windows machines around the world, grounding flights and disrupting hospitals and banks. That outage involved no criminal at all. It showed the same structural fact from another angle: when many organizations depend on one provider for something that runs every day, a single failure at that provider becomes everyone’s bad week at once.

Consider a store manager on the Monday before Thanksgiving. The rota for the busiest week of the year lives in a system she reaches through a web browser. This morning it will not load. She does not know who is meant to open tomorrow, how many hours each person worked last week, or whether Friday’s paychecks will be right. Nothing about her store has been hacked. Somewhere far away, a software company she has never thought about has been.

Blue Yonder’s customers lived through some version of that in late November 2024, and it points to a gap in how most large organizations think about their suppliers.

Vendor risk programs at banks, health systems and agencies are usually organized around data. Their questionnaires ask what sensitive information a vendor holds, how it is protected and how fast a breach will be reported. Those questions matter. Blue Yonder, following Change Healthcare and CDK Global earlier in 2024, showed what they miss. A vendor that runs a business process can stop that process, and no organization can buy a replacement scheduling, claims or core platform within a week.

A better register sorts suppliers by what the organization loses if the vendor fails. There are three possibilities: data custodians, whose failure exposes information; process operators, whose failure stops work; and commodity suppliers, whose failure costs money but can be fixed by switching. Process operators also hold data, so they inherit every data control. What separates them is that availability, not confidentiality, sets their risk.

From owning software to renting a process

Twenty years ago, most large companies bought software outright. They installed it in their own data centers, on their own servers, and their own staff kept it running. If it broke, the problem and the fix were in-house.

Today much of that software is rented as a service, often called SaaS (software as a service). The vendor runs the application on its computers, or on computers it rents from a large cloud provider, and customers use it over the internet. Blue Yonder’s managed services offering went a step further: the vendor hosted and operated the environment on its customers’ behalf. The arrangement is convenient, often cheaper overall and usually more reliable than running the software in-house. But if the vendor has a bad day, its customers stop too, and they cannot take over the controls.

Most of these services are multi-tenant, meaning many customers share the same underlying systems, separated by software rather than by physical walls. The arrangement works like an apartment building rather than a row of detached houses: sharing makes it efficient, and a fire in the basement affects every tenant at once.

Ransomware has repeatedly been that fire. Attackers get in, often through a stolen password, an unpatched system or a tricked employee, then move unnoticed through the network until they can encrypt as many systems as possible at the same moment. Encryption scrambles data so that it is unreadable without a key, which the criminals hold. Recovery means either paying for the key, which is no guarantee, or rebuilding systems from clean backups, which takes days or weeks for a large environment. Increasingly, gangs also steal copies of data first, as the Termite group said it had done, so that even a victim who rebuilds faces a threat of publication.

Put those pieces together and you get the 2024 pattern. A criminal group attacks one software provider. Because that provider runs a critical process for hundreds or thousands of customers, the damage multiplies. Change Healthcare touched claims and payments across U.S. health care. CDK Global touched thousands of dealerships. Blue Yonder touched store schedules, pay and warehouses.

Why one intrusion becomes hundreds of outages

The multiplication is a matter of plumbing. A hosted environment shares more than servers. It usually shares an identity system for administrators, management tools used to deploy and patch every tenant, and backup infrastructure. Often it also shares a virtualization layer on which customers’ workloads run as separate virtual machines. An intruder who reaches any of those shared layers can touch every tenant without breaking into each one.

Ransomware crews know this. Babuk, the operation researchers linked to Termite, was among the groups whose code included a version for VMware ESXi, the hypervisor on which many hosted environments run. Encrypting a hypervisor locks every virtual machine on it in one step. Babuk’s source code leaked in 2021 and was reused by other gangs, which made that capability cheap to acquire.

The vendor’s first response then deepens the outage for customers. A sensible incident team isolates the environment, cutting the network links, file transfers and application interfaces that connect it to customer systems. Starbucks described exactly that: its connections to Blue Yonder were cut. Isolation protects customers from the attacker. It also stops their data feeds, their integrations with payroll and point-of-sale systems, and any automated work that depended on the hosted service.

Two clocks, not one

Restoration then runs on two clocks. The first is the vendor’s: rebuilding servers, restoring data from backups, checking that the attacker is gone. The second belongs to each customer. Before a bank, hospital or retailer reconnects its own systems to a vendor that has just been compromised, its security team wants evidence that the rebuilt environment is clean. That usually means a written summary from the vendor’s forensic firm, indicators of compromise to scan for, and a description of what changed.

The second clock is often slower than people expect. Vendors are reluctant to share forensic detail while litigation and insurance claims are pending. Customers’ security teams are reluctant to reconnect without it. The result is a stand-off measured in days, during which the business is still running on its fallback. Agreeing in the contract what evidence the vendor will provide before reconnection shortens that stand-off more than almost any other single term.

Data custodians: exposure without stoppage

Data custodians hold sensitive information but do not run critical day-to-day work. Archiving services, analytics platforms, survey tools and some marketing systems fit here. A breach brings notification duties, regulatory inquiries and reputational harm. An outage is an inconvenience.

Most vendor programs are built for this category, and questionnaires, attestations and contract terms on breach notification handle it reasonably well. An attestation, for readers who have not had to read one, is a formal report, usually from an outside auditor, stating that a vendor’s controls were designed and operating as described over a period. They are useful evidence that a vendor protects its systems, and say much less about how fast it can rebuild them after an attack.

The usual gap with custodians is scope creep. Custodians accumulate more data than the original contract contemplated, as teams upload extracts for one-off projects and never delete them. A marketing analytics tool licensed to study website traffic ends up holding a full customer list because someone needed it for a campaign two years ago. An annual data inventory per custodian, with deletion of anything outside the contracted purpose, is the improvement that matters most.

Where custodian risk actually comes from

Custodian breaches often begin on the customer’s side of the line. In 2024, attackers used stolen credentials to log in to customer accounts on Snowflake’s data platform, many of them without multi-factor authentication. They took large volumes of data from companies including AT&T and Ticketmaster. Snowflake’s own core platform was not reported to have been breached. The exposure came from how customers had configured access to it.

That pattern changes what a good custodian review looks like. The vendor questionnaire matters, and so does the customer’s own configuration. Every account on the platform should require multi-factor authentication. Service accounts should be restricted to known network addresses, bulk exports should trigger alerts, and someone should review who still has access. Those controls are owned by the customer, not the vendor, and they rarely appear in a vendor risk file.

Notification clocks differ by regime

For custodians, the contract’s breach-notice clause needs to match the regulatory clock the organization itself faces, and those clocks differ by type of institution. HIPAA requires business associates to report breaches of unsecured protected health information to the covered entity without unreasonable delay, and no later than 60 days after discovery. Federally insured credit unions must notify the NCUA within 72 hours of a reportable cyber incident under a rule that took effect in 2023. Banks supervised by the federal banking agencies must notify their regulator within 36 hours of a notification incident.

Securities firms have their own regime. The SEC’s 2024 amendments to Regulation S-P require broker-dealers, investment advisers and other covered institutions to oversee their service providers. Those providers must notify the institution within 72 hours of a breach affecting customer information. Nonbank financial institutions under the FTC’s Safeguards Rule must report certain breaches to the FTC. A contract that gives a vendor 30 days to report is useless to an institution that owes its regulator an answer in 36 or 72 hours. Organizations should check with counsel which clocks apply to them.

Exit terms matter too. A custodian should certify deletion of the organization’s data at the end of the contract, including copies in backups once they age out. Without that, data the organization stopped using years ago can still turn up in someone else’s breach.

Process operators: stoppage the organization cannot buy its way out of

Process operators run workflows the organization depends on: workforce scheduling and payroll, claims processing, core banking, electronic health records, benefits eligibility and permitting. A core banking system is the ledger that records every account balance and transaction; an electronic health record is the system where clinicians read and write a patient’s history, orders and medications. When either stops, the organization loses the ability to do the job it exists to do.

For Blue Yonder’s customers the immediate problem was operational. Schedules, pay calculations and warehouse work could not run normally. Whether data had been stolen was a question for later. The urgent question was who was working tomorrow and whether they would be paid.

This category needs a different set of questions. The first is how many days the organization can operate without the vendor, and what manual fallback it would use. Next comes when that fallback was last exercised, and whether the organization holds a recent export of its own data in a format usable without the vendor’s software. Then come how fast the vendor has actually restored service in tests, whether those results can be seen, and what happens to pay, patient care or public services in the meantime.

The answers should drive contract terms. Useful clauses start with restoration time commitments matched to the organization’s real tolerance. Add scheduled data exports delivered to storage the organization controls, rights to see recovery test results, and notice within hours of a disruption. Finally, allocate the extra costs of manual operation during an outage. These terms cost money or negotiating effort, which is why they belong only in process-operator contracts.

What changes by type of organization

The process operators look different in each sector, and so do the rules that cover them. For a community bank or credit union, the most important one is usually the core processor, a market dominated by a few large providers. The federal banking agencies can examine those providers directly under the Bank Service Company Act. The Federal Reserve, FDIC and OCC also set out their expectations for bank oversight of third parties in joint guidance issued in June 2023. The NCUA has long asked Congress for similar authority over credit union vendors and does not have it, so credit unions carry more of the diligence burden themselves.

Banks also have a disruption-specific rule that most other sectors lack. The interagency computer-security incident notification rule took effect in 2022. Under it, a bank service provider must notify its bank customers as soon as possible when an incident has disrupted or is likely to disrupt covered services for four or more hours. That is a process-operator rule. It is triggered by stoppage, not by data loss, and banks should confirm their contracts reflect it.

For a health system, the obvious process operator is the electronic health record, often hosted by its vendor. The less obvious ones are the clearinghouses, eligibility services and revenue-cycle platforms that sit between providers and payers. Change Healthcare was one of these, and its outage showed that a provider can be clinically operational and still unable to get paid. The HIPAA Security Rule already requires covered entities to have contingency plans, including data backup, disaster recovery and emergency mode operation. Few of those plans, as written in 2024, assumed that the disaster would happen at a vendor.

Ambulatory networks and physician groups are more exposed than large systems. They have thinner cash reserves, fewer staff who know how to work manually, and less bargaining power with vendors. During the Change Healthcare outage, CMS offered accelerated and advance payments to providers whose claims had stalled. It was a reminder that the backstop for a process failure may be a government program rather than the contract.

For public agencies, the process operators include benefits eligibility systems, unemployment insurance platforms, permitting and licensing portals, and computer-aided dispatch for emergency services. A county often runs these through a single hosted vendor chosen years ago, with no internal team able to operate an alternative. Federal agencies buying cloud services rely on FedRAMP authorization, which assesses security controls in depth but says less about how quickly a provider recovers from a destructive attack. State and local agencies may have no equivalent program at all.

Securities firms have the most explicit rule. FINRA Rule 4370 requires broker-dealers to maintain business continuity plans that address, among other things, mission-critical systems and the impact of disruption at critical business constituents, banks and counterparties. A broker-dealer whose order management or clearing depends on a hosted provider already has a written obligation to think about this category, whether or not its vendor program reflects it.

A regime that already thinks this way

British financial regulators had built a framework around this idea before Blue Yonder. The Bank of England, PRA and FCA operational resilience rules took effect in 2022, with a transition to the end of March 2025. They require firms to identify their important business services, set an impact tolerance for the maximum disruption each can bear, and show they can stay within it in severe but plausible scenarios.

The structure matters more than the jurisdiction. The rules start from the service the customer receives and work backward to the people, processes, technology and suppliers it depends on. That reverses the usual vendor program, which starts from the supplier and asks what data it holds. An American bank, health system or agency can adopt the same sequence voluntarily. List the services that must not stop, map each to the vendors it runs on, and set a tolerance in hours or days before negotiating anything.

Concentration: when everyone shares the same basement

Concentration adds a second-order risk. When one hosted environment serves many customers, an attack hits all of them at once and the vendor’s recovery teams are stretched. Organizations should ask how many customers share their environment and how the vendor decides restoration order. Large customers often find they are not first.

In an ordinary outage, a big customer can call its account executive and expect attention. In a mass outage, the vendor is triaging hundreds of customers with the same engineers. Restoration order may follow technical logic, contractual commitments or simple first-come-first-served. If you do not know which, you cannot plan around it.

Concentration also hides one layer down. A process operator depends on its own suppliers: a cloud platform, an identity provider, a managed security firm, sometimes a subcontracted support team. These fourth parties rarely appear in a customer’s register. Asking a critical vendor to name the few suppliers whose failure would stop its service is a reasonable request. The answer often reveals that several of the organization’s process operators share the same underlying dependency.

The natural response is to diversify, and it is usually the wrong one for software. Running two scheduling systems or two claims platforms in parallel doubles cost, splits data and creates reconciliation work every day to protect against a bad week every few years. For most organizations, accepting concentration and investing in the ability to operate without the vendor for a defined period is the better trade. Diversification makes more sense for commodity inputs, such as network carriers, than for systems of record.

Pricing a week of outage

The economics of this category also change the budget conversation. Spending on a process operator’s resilience is usually split across procurement, IT and the business owner, so nobody sees the whole cost or the whole risk. A useful discipline is to price one week of outage for each process operator, covering overtime, manual processing, delayed revenue and penalties, and set that figure beside the annual contract value. Where the outage cost dwarfs the contract, paying more for stronger terms or a warm standby is easy to justify.

Suppose a regional hospital group pays a modest annual fee for a cloud scheduling and timekeeping service for its nurses. Its finance team estimates what one week without that service would cost. The list includes supervisors rebuilding rotas on spreadsheets, overtime to cover confusion, agency staff to fill gaps, payroll corrections afterward and time spent answering anxious employees. If that one-week figure comes out at several times the annual fee, the case for paying extra for a contractual restoration commitment, regular data exports and a rehearsed paper fallback writes itself. A warm standby is a backup arrangement kept partly ready, as opposed to a cold one that would have to be built from scratch.

One caution on the money. Standard SaaS service-level credits are typically capped at a fraction of the monthly fee. They were designed to compensate for a slow afternoon, not a three-week rebuild. Vendors also resist uncapped liability for security incidents, and most customers lack the bargaining power to win it. The value of stronger terms lies in behavior more than compensation: earlier notice, defined evidence before reconnection, a clear place in the restoration queue, and data the organization can use without the vendor.

Insurance can fill part of the gap. Many cyber policies offer contingent business interruption cover for losses caused by an outage at a supplier. The details matter: waiting periods before cover starts, sublimits lower than the main policy limit, and definitions of which suppliers count. A risk manager who has priced a week of outage per process operator can check whether the policy would actually respond, and at what amount.

Payroll is where it hurts first

Payroll deserves particular attention because the harm lands on employees within days. Starbucks’ first public concern was paying baristas correctly. A health system or agency that cannot run payroll faces staff hardship, possible wage-law exposure and, quickly, staffing gaps in care or services. Preparation is modest: retain the last few pay registers locally, agree a method for paying staff an estimate and reconciling later, and pre-draft the message to employees. The December 2021 ransomware attack on a cloud workforce management service had already shown employers, including hospitals and local governments, why this matters.

A pay register is simply the record of who was paid what in a given pay period. Keeping the last few copies on your own systems means that, in an emergency, you can pay everyone roughly what they received last time and correct the differences once the vendor is back. It is not elegant, but it keeps people paid and trust intact.

The UKG episode showed what that costs. The attack on UKG’s Kronos Private Cloud in December 2021 hit during the holidays, with overtime and holiday pay at their most complex. According to SHRM, UKG did not restore core time, scheduling and payroll for all affected customers until January 22, 2022, more than five weeks later. Franciscan Health, a group of Midwest hospitals, built a manual payroll process and paid nurses incentive pay for extra shifts, then had to load a month of manual records back into the system afterward.

That back-loading is the hidden cost. Estimated pay protects employees in the moment, but every estimate creates a correction: overpayments to recover, underpayments to top up, tax withholding to adjust, and benefit deductions to reconcile. A plan should decide in advance which errors the organization will absorb rather than claw back. Recovering small overpayments from frontline staff after a crisis does more damage to trust than the money is worth.

The legal exposure differs by employer. Private employers owe nonexempt workers pay for all hours worked under the Fair Labor Standards Act, and state wage-payment laws set their own timing rules and penalties for late pay. Public employers often have collective bargaining agreements that specify pay dates and overtime rules. Health systems add a clinical dimension, because nurses who are unsure they will be paid for extra shifts are less likely to pick them up. Each of these is a reason to decide the payroll fallback before the outage, with HR, finance and counsel in the room.

Commodity suppliers: replaceable by design

Some suppliers provide services that can be switched quickly, at a cost: office supplies, standard software licenses, some communications tools. They warrant light oversight, which frees attention and budget for the other two groups.

The catch is drift. A tool bought as a commodity can become a process operator once teams build workflows on top of it. A form builder becomes the intake system for a benefit program; a ticketing tool becomes the route for clinical equipment requests. Reclassification should be triggered by usage, not by renewal dates. A simple prompt in the annual vendor review, asking business owners what would stop if the tool vanished tomorrow, catches most of it.

Say a county bought an inexpensive online form service to collect feedback at public meetings. Three years later, its housing office uses the same service as the only way residents apply for emergency rental help. Nobody in procurement noticed the change, because the contract value never moved. On paper it is still a commodity. In practice, if it fails, vulnerable residents cannot apply for help and the county cannot meet its program deadlines.

Detecting drift without reviewing everything

Reviewing every low-cost tool in depth is impractical, and an organization that tries will drown in paperwork. Drift shows up in signals that are already collected. Single sign-on logs show which applications are used daily by large numbers of staff. Integration inventories show which tools hold API connections to systems of record. Expense and card data show subscriptions that grew from one seat to hundreds. Each of these is a cheap trigger for a second look.

A practical rule is to reclassify any tool that becomes the only route for a regulated or customer-facing process, or that is connected to a core system, payroll or an EHR. The reclassification should change the owner’s obligations too: a business owner who has turned a commodity tool into a process operator becomes responsible for its fallback plan. That shifts the incentive to the people who caused the drift and who best understand what the tool now does.

Where the damage lands: money, people, regulators and reputation

Events like Blue Yonder land in four places a senior leader already owns.

• Money. Outages of process operators create direct costs (overtime, manual work, emergency contractors) and indirect ones (delayed revenue, missed service levels, penalties). These costs often exceed what the organization pays the vendor in a year.
• People. When scheduling and pay fail, it is frontline employees who feel it first. They are the baristas, nurses, warehouse pickers and clerks who keep the organization running. How leaders handle the first payday after an outage shapes trust for a long time.
• Regulators. Banking, insurance and health regulators increasingly expect firms to understand and manage dependence on critical outside providers as well as the confidentiality of data those providers hold. Wage-and-hour laws do not pause because a supplier was attacked.
• Reputation. Customers and the public rarely distinguish between your failure and your vendor’s. The brand on the storefront, the hospital or the agency website is the one that takes the blame.

Disclosure runs in both directions

For public companies, the SEC’s cybersecurity disclosure rules, in force since December 2023, add a further layer. A registrant must disclose a material cybersecurity incident on Form 8-K within four business days of determining it is material, and the SEC made clear that incidents on third-party systems are not exempt. A retailer, bank holding company or hospital operator whose operations stall because of a vendor’s ransomware has to make its own materiality call. It cannot rely on the vendor’s.

The two assessments can diverge sharply. A vendor with diversified revenue may conclude, correctly, that an incident is not material to its own finances. The same incident may be material to a customer whose core operations stopped. Materiality is assessed by each company against its own business, and process operators concentrate impact on their customers, not on themselves.

Where costs and duties fall by organization type

The split of consequences also varies by organization. A retailer absorbs most of the cost as lost sales and overtime. A health system faces a cash-flow problem when claims stall, plus clinical risk if scheduling or ordering systems are involved. A bank faces supervisory scrutiny and, for some services, customer harm that must be remediated. A public agency faces statutory deadlines that do not move, such as benefit payment dates, and political accountability that falls on elected officials. The same vendor outage produces a different worst case in each, which is why the tolerance has to be set by the organization rather than borrowed from an industry benchmark.

The common thread is that the consequences belong to the organization, even when the cause sits with a supplier. Outsourcing the work does not outsource the responsibility.

Habits of the better-prepared

Organizations that handle this well tend to share a few habits.

• They classify by consequence. Every supplier is tagged as a data custodian, process operator or commodity supplier, and the tag drives the depth of diligence, the contract terms and the contingency budget.
• They keep a copy of what matters. For each process operator, the organization receives regular exports of its own data, in a usable format, into storage it controls.
• They rehearse the fallback. Paper rotas, manual claims queues and estimated payroll are tested rather than left on paper. A plan that has never been used tends to fail on first contact with a real outage.
• They ask about the neighbors. They know roughly how many other customers share their vendor’s environment and how restoration priority is decided.
• They name one owner. A single executive sees the full cost and risk of each process operator, rather than leaving it split across procurement, IT and the business.

The mistakes are just as consistent. The most common is treating a clean security questionnaire as proof of resilience. A vendor can protect data well and still take weeks to recover from a mass outage. A second is reviewing vendors only at renewal, which misses the commodity tool that gradually became critical. A third is assuming the biggest customers are first in line for recovery. A fourth is writing a manual fallback that depends on the very system that is down, such as a contingency plan stored inside the scheduling tool.

The case against sorting by consequence

There are serious objections to this approach. The first is that the categories blur. Almost every SaaS tool both holds data and runs some process, so classification becomes a matter of judgment and can be gamed by business owners who want less scrutiny. The answer is to classify by the most severe consequence and to require a named executive to sign the classification, which makes downgrading a decision someone owns.

The second objection is bargaining power. A large bank can negotiate restoration commitments and recovery-test access. A small credit union, a rural hospital or a county often cannot, because it buys on the vendor’s standard paper. For these buyers, the realistic tools are collective: joint purchasing through associations or credit union service organizations, and reliance on regulators’ examinations of significant service providers where those exist. The remaining tool is investment in their own fallbacks, which require no one’s agreement.

The third objection is that manual fallbacks decay. Staff who learned paper rotas leave, forms go out of date, and a plan rehearsed once in 2024 may be useless by 2026. That is true, and it is why rehearsal has to be scheduled, short and repeated, ideally folded into existing drills rather than run as a separate program. A one-hour exercise each year in which a store, ward or office runs a shift without the system costs little and keeps the knowledge alive.

The objections refine the approach without undoing it. Data-centered vendor programs answer the question regulators and auditors asked first. The 2024 incidents showed that, for a subset of suppliers, a different question decides how bad the day gets. Organizations that keep both questions, and know which vendors need the second, are better placed than those that keep only one.

Before the screen goes blank

Vague answers to these are themselves useful information.

A realistic first quarter of work is modest. In the first month, list every supplier whose failure would stop pay, care, customer service or a legal deadline, and name an owner for each. In the second, set a tolerance for each in hours or days and arrange a data export to storage the organization controls. In the third, run a short tabletop exercise for the most important one, with the business owner, IT, HR and communications present. The questions below test whether that work has been done.

1. Which of our suppliers, if they disappeared for a week, would stop us paying staff, serving customers or meeting a legal deadline?
2. When did we last practice working without each one, and what went wrong when we did?
3. Do we hold a recent copy of our own data from each of them, somewhere we control, in a form we could actually use?
4. If payroll could not run on schedule, how would we pay people, and what would we tell them on day one?
5. Which tools did we buy as low-risk that our teams now cannot work without?

A leader does not need to understand encryption or network design to ask them. The job takes the instinct a good executive brings to any critical dependency. Know what you rely on, know what happens if it fails, and pay for resilience in proportion to the damage a failure would do.

With hindsight

Blue Yonder restored services for affected customers over the following weeks; by mid-December it said a significant majority had service back. The incident joined a run of attacks on software providers that spread from one vendor to many customers. For the retailers involved, the story moved from crisis to cleanup fairly quickly. For anyone thinking about supplier risk, it left a more lasting mark.

In January 2025 the EU’s Digital Operational Resilience Act took effect for financial entities, with its focus on ICT third-party concentration. “ICT” stands for information and communications technology, and “concentration” refers to exactly the risk Blue Yonder illustrated: many firms depending on the same small set of technology providers, so that one failure spreads widely. The law turned that worry into a formal obligation for banks, insurers and other financial firms in Europe.

The mechanics of DORA show how a regulator turns that worry into work. Financial entities must keep a register of information listing their ICT third-party arrangements and which of them support critical or important functions, and supervisors collected those registers during 2025. The registers feed an EU oversight framework under which the European supervisory authorities designate critical ICT third-party providers and oversee them directly. The register is, in effect, a regulator-mandated version of the classification this article argued for, organized around the functions a firm cannot lose.

Britain moved in parallel. Its regime for critical third parties to the financial sector, set out by the Bank of England, PRA and FCA in late 2024, gives regulators powers over providers that HM Treasury designates. The deadline for UK firms to show they could stay within impact tolerances for their important business services fell at the end of March 2025. American banking regulators did not adopt an equivalent designation regime, so U.S. institutions continued to rely on the 2023 interagency guidance and on examinations of service providers.

The pattern recurred outside finance. In September 2025 a ransomware attack on Collins Aerospace’s passenger processing software disrupted check-in and boarding at several European airports, including Heathrow, Brussels and Berlin. That was another process operator shared by many customers, with manual fallback carrying the load. Travelers saw staff checking in passengers by hand, which is precisely what a rehearsed fallback looks like when the shared system is unavailable: slower and more expensive, but still running.

RTX, Collins’s parent, said in an SEC filing that it had become aware of ransomware on systems supporting the software on September 19, 2025. It said customers had shifted to backup or manual processes. It also said the incident had not had, and was not reasonably expected to have, a material impact on its finances. For airports cancelling flights, the impact was plainly material. The filing is a clean illustration of the asymmetry described above: a process operator can be fine while its customers are not.

Other 2025 incidents filled in both halves of the taxonomy. In June, United Natural Foods, the wholesaler that supplies Whole Foods and many independent grocers, disclosed a cyberattack that disrupted its ordering and distribution, and some grocers reported shortages while its systems were restored. It was a process operator in physical form. In August, attackers used stolen tokens from the Salesloft Drift integration to pull data from many companies’ Salesforce environments. Nothing stopped running. Data left. That was a custodian-style exposure, spread through a connection most victims had approved and then forgotten.

The Change Healthcare breach also kept growing in scale. In January 2025, UnitedHealth said the data of about 190 million people had been affected, making it the largest health data breach reported in the United States. The incident that began as a payment stoppage ended as both kinds of harm at once, which is a reminder that process operators inherit every data control as well.

The distinction between data risk and process risk has been easier to see in incident reports than in vendor questionnaires, which in many organizations still lead with data protection. That gap is what remains to close. Questionnaires are written in calm times and tend to ask about what is easy to measure, such as encryption settings and certifications. Incidents reveal what actually hurts, which is usually the work that stops.

Resilience now depends partly on suppliers whose names rarely reach the boardroom. The useful response is to keep buying hosted services, which bring real benefits, while knowing which of them run the processes you cannot live without. Keep your own copy of what matters, and make sure your people know how to keep working, and keep getting paid, on the day the screen goes blank.