Trending Articles
Trending Topics
Trending
According to a Sophos report into the state of ransomware in the retail sector this year, compromised credentials were the biggest root cause of attacks in the UK. And 33% of incidents were pinned on poor passwords.
Globally, Sophos found that it took 28% of ransomware-impacted retailers more than a month to recover from such an incident. And that 39% of those organisations now require their suppliers to have some form of cyber insurance policy in place.
Why am I throwing these statistics at you? Because retailers are firmly in the crosshairs once again, with the fallout from the Blue Yonder ransomware attack.
“While the full impact of this particular attack remains unclear,” the Sophos Director of Incident Response, Peter Mackenzie, said, “affected customers often have limited options while awaiting remediation.”
And remediation appears to be taking some time. Blue Yonder, which provides an AI-powered platform providing everything from fulfillment to logistics help, fell victim to ransomware on 21 November. The last time it updated the company cybersecurity incident page was four days ago, 24 November, when it stated: “There are no additional updates to share at this time with regard to our restoration timeline.”
Well, I’m sure its customers will be pleased to hear that. Customers such as Starbucks in the US, which told me that while serving coffee from the counter has not been impacted, the same can’t be said of the back office systems.
Jaci Anderson, Starbucks’ Director of Corporate Communications, didn’t want to be quoted directly but confirmed that the incident had disrupted a back-end Starbucks process that enables the employee hours platform. This allows employees to view and manage their schedules and track hours worked. Starbucks also said that all employees had been fully paid and anticipated that Thanksgiving holiday weekend pay wouldn’t be impacted.
“We’ve reached a point where a lot of companies outsource functions like payroll, HR forms, etc to service providers,” said Michael Smith, CTO at Vercara.
“While we should have service level agreements, they are applied after the service interruption and are not a preventative measure.”
And that’s partly the problem here, a reliance upon reactive rather than proactive security along the supply chain. A couple of years ago, maybe more, ransomware gangs realised that primary targets were reasonably well defended, so they switched to the supply chain, to service providers.
That’s “because service providers have multiple customers,” Smith explained, “and a ransomware incident penalises them with SLAs, they are more likely to pay a ransom.”
Paul Caron, Head of Cyber Security, Americas, at global intelligence firm S-RM, takes issue with calling this a supply chain attack, however.
“The Blue Yonder incident attack should not be confused with the type of cyberattack called a ‘supply chain attack’, which is a means to access vendors’ networks of their clients,” he said.
And he’s right, in the sense that the attackers don’t appear to have been after lateral movement towards customer data breaches. But he’s also wrong, in that it is definitely an attack against a provider in the supply chain. The details are semantics in the end.
I won’t argue with Caron when he says that companies should “routinely test the organisational operating procedures for when third-party services become unavailable,” as that, dear reader, is just common security sense. What a shame so many companies don’t seem to possess it.
