The Software That Tells the Supermarket What to Order

On 21 November 2024 Blue Yonder, a supply-chain software provider used by retailers and manufacturers worldwide, was hit by ransomware. Reporting placed Starbucks, Sainsbury’s and Morrisons among the customers affected.

The company sells the systems that plan replenishment, route warehouse work and schedule staff — the layer between a shop’s shelves and everything that fills them.

A shopper who found a gap on a shelf, or a barista whose shift was worked out by hand that week, had no relationship with Blue Yonder and no way to know it existed.

That is the concentration theme in its ordinary form, and the corpus records it repeatedly. What makes this file useful is how far the consequence travelled: an American software vendor’s outage changed what was on sale in British supermarkets.

No notification obligation attaches to a delayed pallet. The corpus filed at 24-1231 that four large 2024 incidents did most of their damage by stopping things and none produced an availability figure anybody had to file; Blue Yonder is a fifth.

Data was taken as well — filed at 24-1205 — and that half will produce counts and notifications. The half that emptied shelves will produce nothing.

Retailers audit their suppliers of goods. The software that decides which goods to order sits at a different layer, is bought by a different function, and tends not to appear in a resilience review as a single point of failure across an entire sector.

This desk has no figure for how many retailers depend on the same planning vendor, and has seen none published. The absence is the finding — the exposure is concentrated to a degree nobody outside the industry can measure.