Desk live·
ForensicPost
Ransomware/Fallback/File 24-1125

Starbucks and Morrisons Fell Back to Manual Processes After Blue Yonder Outage

Starbucks worked out shifts and pay manually. Morrisons fell back to a slower warehouse process. Both fallbacks held, and both were slower than the systems they replaced.

Constructed geometry · not a chart of case data
JurisdictionUnited Kingdomthe affected organisation’s jurisdiction, not the actor’s suspected origin
TargetBlue Yonder customers
ActorTermite
S. Rosler12 min readConfidence: medium3 sources reviewed

Reporting described Starbucks moving to manual processes to ensure staff were scheduled and paid correctly, Morrisons reverting to a slower backup process for fresh produce, and Sainsbury’s working to established contingency plans.

None of them stopped. That is the outcome the fallback theme in this corpus exists to notice, and it is worth stating before anything else.

Fresh Produce Is The Detail That Carries The Argument

A slower process for tinned goods costs margin. A slower process for produce costs the produce, because the constraint is not throughput but shelf life.

That is the shape of availability harm this database keeps failing to measure: not a number of records, but perishable stock, hours of staff time, and shifts worked out by somebody who should have been doing something else.

Paying People Correctly Is The Load-Bearing One

Workforce systems compute hours, premiums and overtime. Doing that manually across a large estate is possible for a week and error-prone throughout, and the errors land on individual employees rather than on the company.

The corpus recorded the same displacement at 24-0711: the party that could have prevented the incident and the parties who absorbed the cost were different parties. Here the final absorber is a shift worker whose pay was calculated by hand.

These Fallbacks Are Older Than The Systems

Somebody at Morrisons knew the slower warehouse process because it predates the software. Somebody at Starbucks could work out a rota on paper. The corpus argues that this capability is inherited, untracked, and reduced by every efficiency programme.

Graded medium: the fallback descriptions come from contemporaneous reporting and company statements rather than from any operational account this desk has reviewed, and no duration or cost figure is established.

How we reported this

Compiled from contemporaneous reporting of customer responses, listed below. The descriptions of manual scheduling and backup warehouse processes are as reported; this desk has not seen an operational account from any of the companies and gives no figure for duration or cost. The argument about perishable stock is this desk’s and is not a finding about any specific loss. Graded medium. Corrections: corrections@forensicpost.com.

Sources
  1. Ransomware meets retail: Sainsbury's, Starbucks and Morrisons feel the heatBlackFog
  2. The Blue Yonder ransomware attack: a wake-up call for supply chain resilienceSemantic Visions
  3. The Blue Yonder cyberattack: a critical lesson for supply chain securitySupplyChains Magazine
S. Rosler
Covers extortion groups and leak-site economics. Verifies our sample sets.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary