When the Network Goes Down, It's Not an IT Problem
A cyberattack on Hasbro is a reminder that digital breaches have physical consequences, and supply chain teams are the ones left holding the bag.
What does a cyberattack actually look like from inside a supply chain?
Not the breach itself. Not the forensics team or the SEC filing. The part that follows: the orders that can’t be processed, the shipments that don’t move, the emails that bounce back with no explanation.
That’s where Hasbro is right now. The company, which makes Play-Doh and Transformers, suffered an attack discovered on March 28 when an unauthorized party gained access to its network. Hasbro has since activated business continuity plans to manage its ability to accept orders and ship products, and is warning that product delays could stretch out for weeks.
The reflexive framing for this kind of story is cybersecurity. Unauthorized access. Data exposure. Regulatory disclosure.
That framing isn’t wrong. It’s just incomplete.
The more useful frame is operational risk. Because whatever happened to Hasbro’s systems on March 28, what it actually produced was a supply chain disruption. Orders can’t be accepted. Shipments aren’t going out. A major toymaker is sitting on inventory it can’t move.
That’s not a security problem. That’s a fulfillment problem.
And yet most organizations still route cyber incidents directly to IT, where they get managed as a technology issue with occasional updates sent to operations when something relevant surfaces. The supply chain team finds out when something stops working. Not before. Not in time to activate alternatives.
This is the gap. And it’s not about who owns the incident. It’s about how the organization thinks about risk.
Cyber exposure has always had physical consequences. A compromised order management system doesn’t stay digital. It grounds shipments. It delays restocks. It creates backlogs that take weeks to unwind even after the technical issue is resolved. The operational blast radius of a network intrusion is bigger than most supply chain risk frameworks account for.
With AI accelerating both the volume and the sophistication of attacks, this isn’t a fringe scenario anymore. It’s a standard category of disruption that belongs alongside port congestion, supplier failures, and weather events on every risk register.
We watched something like this play out firsthand with Stryker, a medical device company.
The attack took weeks to resolve. Stakeholder meetings ran in parallel trying to track the operational impact. Emails to Stryker reps were bouncing back undelivered, so the normal channels for getting information or working around the problem simply didn’t exist.
What struck me was the framing inside our own organization. Nobody was asking about IT. Nobody was troubleshooting the network. Because from where we sat, it wasn’t a network problem. It was a product delay problem. And for the patients at the end of that supply chain, the ones waiting on devices needed for procedures in hospitals and clinics, it was a patient care problem.
The end customer is never asking what went wrong with the firewall. They’re asking when their product is arriving.
For founders building logistics and fulfillment platforms: functionality is the baseline. The next evaluation criterion coming down the enterprise checklist is resilience.
Specifically, what does your platform do when a customer’s systems go down? Can your software isolate a breach and keep operations running in a degraded state? Can you reroute order flows, flag at-risk shipments, or maintain visibility when upstream systems go dark? Or does everything halt because your platform assumed a clean environment?
Hasbro had business continuity plans in place. The question for your customers is whether your software is part of theirs.
Build for the disruption. Not just for the clean run.
Source: Supply Chain Dive | Cyberattack hits Hasbro, impacting orders and shipping