A recent reconstruction of earlier events
ESET’s research published on October 22, 2026 reconstructs an intrusion into a Ukrainian grain logistics company, beginning on July 16, 2025 and followed by data wiping on September 17. Its researchers assess a transfer of access from UAC-0099 to Sandworm, which ESET links to Russia, and describe a backdoor communicating through the Yggdrasil network. The publication is recent, while the events occurred in 2025 and the attribution remains ESET’s assessment.[1]
This analysis, dated October 26, 2026, considers what such a threat configuration implies for supply-chain preparedness. A digital compromise alone cannot establish the volume of goods held up or the resulting economic loss, since dependencies, alternatives and operating conditions intervene between the loss of a system and the interruption of an activity, each requiring separate examination.
The operational value of information
Understanding the strategic significance of a threat to logistics begins with the decisions that allow goods to move. Within a supply chain, the physical existence of stock may be insufficient to make it usable when its destination, availability or delivery conditions cannot be established with adequate confidence. An assessment of resilience should therefore examine which information enables each operation and how long an organization can continue working when that information becomes unavailable or uncertain.
From this perspective, the distinction between digital security and physical continuity becomes less useful whenever it separates responsibilities that never meet. Those managing infrastructure may understand the condition of the systems without a complete view of commercial priorities, while those coordinating material flows may not know which shared services support scheduling. Preparedness becomes meaningful when these forms of knowledge are brought together before a crisis, allowing the sequence of recovery to reflect a reasoned operational choice.
The geopolitical dimension of continuity
In a wartime setting, a cyber-geopolitical assessment must also consider the relationship between an economic target and the possible strategic value of its disruption. This requires testable hypotheses that distinguish a sector’s significance within a conflict from the intentions attributed to an attacker. An operation’s compatibility with a state’s interests may guide further research, but it does not discharge the burden of establishing responsibility, coordination and specific objectives.
For an Italian business relying on suppliers, intermediaries or logistics services exposed to conflict, this approach suggests a more precise inquiry than a general country-risk assessment. The organization needs to understand which stages of its activity would be affected by a partner’s unavailability and which information would reveal the problem early enough to activate an alternative. A replacement supplier, although formally available, might depend on the same digital service or require qualification procedures whose duration is incompatible with an urgent need.
Preparedness that can be demonstrated
A useful exercise could assume the temporary loss of the information needed to coordinate a delivery, asking the relevant functions to reconstruct a reliable operating picture and explain the decisions that follow. Its value would lie in observing whether alternative information is accessible, whether someone has the authority to use it and whether actual response times permit essential commitments to be met. The outcome should describe what has been demonstrated while keeping untested conditions visible, so that the exercise provides a basis for corrective work rather than an unsupported assurance of continuity.
The availability of data copies needs to be examined alongside their integrity and the feasibility of using them within a trustworthy environment. If technical restoration preceded a sufficient understanding of the incident, an organization could recover its tools without yet having adequate grounds to trust the operations they support. Readiness acquires a strategic dimension in this interval between recovering a service and recovering the ability to make informed decisions, because it requires technical evidence, managerial responsibilities and the continuity of supply-chain relationships to be assessed together.