What: RH-ISAC uses the attack to show that retailers' vendor risk programmes stop at direct suppliers, leaving fourth-party dependencies such as logistics providers largely unmonitored.

Why it is important: The article frames supplier cyber risk as business-dependency risk: the question for retailers is what stops operating when a supplier does, as M&S found when online sales were suspended for seven weeks.

In late July, a major global logistics provider operating more than 1,700 facilities in 170 countries was hit by a cyberattack that disrupted warehouse operations across Europe. The company told affected customers in early August that several European warehouses could not ship stored goods, and some reported that personal information used for home deliveries may have been exposed. Retailers, a major bank, a video game company and a professional sports club all issued statements on the impact to their own operations or customer data.

The article, quoting IANS Faculty member George Gerchow, describes the incident as a fourth-party breach: most vendor risk programmes stop at direct suppliers, while logistics providers often supply the supplier. He suggests asking critical suppliers for their contractual mean time to notify in hours and which sub-processors touch customer data, with security terms flowing down to them. IANS Faculty member Lisa Perdelwitz adds that third-party cyber risk is business dependency risk, so leaders must understand what happens when a supplier stops functioning.

It recommends four steps: mapping critical dependencies, setting contractual requirements for incident visibility, preparing supplier isolation and continuity plans, and running tabletop exercises simulating a multi-day loss of a critical supplier.

IADS Notes: A cyberattack on logistics partner CEVA exposed De Bijenkorf customers' contact details and payment-method descriptions and delayed orders, returns and refunds (nu.nl, September 2026). A similar third-party dependency sat behind M&S's £136mn profit hit and seven-week suspension of online sales, in an incident traced to human error at a third-party supplier (Financial Times, November 2025). M&S subsequently ended a technology partnership, with vendor oversight and contingency planning identified as the lessons (Retail Week, October 2025). Retail's exposure stems from combining rich customer data with interconnected omnichannel and supply chain systems, which attackers reach through weaker third-party providers (Retail Insight Network, July 2026). The customer-facing damage can also begin before any data loss is confirmed: Asos shares fell more than 10% after app notifications claimed a hack, with customers warned of follow-up phishing (Financial Times, October 2026).

When your vendor's vendor goes down: what a logistics incident teaches retailers about fourth-party risk