The widespread business disruption events of 2024 had one thing in common. Most of the damage arrived through something the affected organizations depended on but did not control: a claims clearinghouse, a pathology lab, a security vendor’s update, a dealer software platform, a single IV fluid plant, a shipping lane.
Very few of the organizations that suffered most in 2024 were hit directly. They were hit through a dependency. That is the business continuity lesson of the year, and it still applies.
Below are six business disruption events from 2024, what happened, and what each one should change in your program. Every fact is sourced. The lessons are mine.
| Old View | New View |
| The disruption hits us | The disruption hits someone we depend on |
| Rank vendors by spend | Rank vendors by what stops when they stop |
| Vendor resilience is a questionnaire | Vendor resilience is an exercise with the vendor at the table |
| Manual workarounds exist in the plan | Manual workarounds have been practiced |
| An IT outage is an IT problem | An IT outage is a business crisis |
The Widespread Business Disruption Events of 2024
1. Change Healthcare: a clearinghouse goes dark (February)
On February 21, 2024, UnitedHealth Group disclosed a ransomware attack on its Change Healthcare unit. Change sits in the middle of US healthcare payments, so the outage stopped claims, eligibility checks, and pharmacy transactions for providers that had never done business with UnitedHealth directly. The American Hospital Association told the Department of Health and Human Services (HHS) that a substantial portion of claims could not be processed (AHA letter to HHS, February 26, 2024). Providers lived on workarounds for weeks, and HHS announced accelerated payment options on March 5 (TechTarget).
The entry point was not exotic. UnitedHealth’s CEO told Congress the attackers used compromised credentials on a remote-access portal that did not have multifactor authentication turned on (Healthcare Dive). Change later reported about 192.7 million affected individuals to HHS, the largest known breach at a HIPAA-regulated entity.
The lesson: your most critical vendor may not be your biggest vendor. For thousands of practices, Change was a line item nobody thought about until cash stopped coming in. If your Business Impact Analysis (BIA) does not trace revenue back through the third parties that move it, it is missing the dependency most likely to hurt you.
2. The Francis Scott Key Bridge: a plan executed in minutes (March)
At about 1:29 a.m. on March 26, 2024, the containership Dali lost power and struck a pier of the Francis Scott Key Bridge in Baltimore. The bridge collapsed. Six highway workers died (NTSB). The ship’s mayday gave police just enough time to stop traffic onto the bridge (AP via FOX 9). The Fort McHenry Federal Channel into the Port of Baltimore was not fully restored until June 10, about eleven weeks later (Land Line). The NTSB later determined the probable cause was a blackout aboard the ship caused by a loose signal wire connection.
Long before founding Bryghtpath, my first assignment out of college with Target was in Baltimore, and I drove that bridge regularly. When I talked about the collapse on Managing Uncertainty, Episode 241, the first reason the toll wasn’t worse was simple: “they had a plan.” A mayday, a closure protocol, and officers who executed it in moments. The second reason was luck, the hour of the night. You can’t plan for luck. You can plan for the first one.
The lesson: the bridge was also a supply chain event. Every business that moved goods through the port or across that bridge had to find another route. A regional infrastructure failure belongs in your scenarios, along with the question of what you will do when the normal path is gone for months, not days.
3. Synnovis: a pathology vendor takes down London hospitals (June)
On June 3, 2024, a ransomware attack claimed by the Qilin group hit Synnovis, the pathology provider for several south east London NHS trusts, including King’s College Hospital and Guy’s and St Thomas’. In the first three weeks, the two trusts postponed more than 2,000 outpatient appointments and more than 1,000 elective operations (Blocks & Files). Because the hospitals could not match patients’ blood at the usual frequency, NHS Blood and Transplant issued an urgent appeal for O-type donors, whose blood can be given more widely (Inside Croydon).
The lesson: the hospitals did not lose their own systems. They lost a vendor’s, and patient care slowed anyway. When a critical service fails, the workaround is often manual, and manual workarounds that have never been practiced are slow, error-prone, and expensive. Name the workaround in the plan. Then run it.
4. CrowdStrike: one update, 8.5 million machines (July)
At 04:09 UTC on July 19, 2024, CrowdStrike pushed a faulty configuration update to its Falcon sensor for Windows. It reverted the update at 05:27 UTC, 78 minutes later (CrowdStrike). By then, Microsoft estimated 8.5 million Windows devices had crashed (Microsoft). Airlines, hospitals, banks, and broadcasters went down at once, and many machines had to be fixed by hand, one at a time (TechTarget). Delta’s CEO put the cost to the airline at about $500 million (NPR).
A month earlier, a different software dependency had made the same point. Cyberattacks on CDK Global starting June 19 knocked out the dealer management system used by more than 15,000 retail locations in North America, and many dealerships went back to writing up orders by hand (AP via ClickOnDetroit).
The lesson: CrowdStrike was not a cyberattack. It was a trusted vendor doing its normal job, badly, everywhere at once. Most disaster recovery plans assume one system fails. This was every endpoint, at the same time, with the same fix needed on each one. Recovery time came down to how many people you had who could touch machines and how fast you could decide which ones mattered first. That is a sequencing decision, and it should be made before the outage, not during it. Our IT disaster recovery guide covers how to set that order.
5. Hurricane Helene: one plant, most of the nation’s IV fluids (September)
Hurricane Helene made landfall near Perry, Florida, as a Category 4 storm on September 26, 2024, then carried catastrophic flooding into western North Carolina (AP via KVIA). Floodwater shut Baxter’s North Cove plant in Marion, North Carolina, which makes about 60 percent of the IV solutions used in the United States. Hospitals nationwide moved to conservation measures (American Hospital Association). North Carolina later estimated the storm’s damage and recovery needs at $59.6 billion (NC Office of State Budget and Management).
I discussed what that meant for health systems on Episode 298: Technology Resilience in Healthcare.
The lesson: concentration risk hides in plain sight. A hospital in Minnesota had no exposure to a hurricane in North Carolina, except that it did. Ask your supply chain team which of your critical inputs come from one site, one supplier, or one region. Then decide, deliberately, whether you accept that.
6. The Red Sea: a chokepoint all year
Houthi attacks on commercial shipping, which began in late 2023, pushed carriers away from the Red Sea for all of 2024. IMF PortWatch data showed trade volume through the Suez Canal down 50 percent year over year in the first two months of 2024, while volume around the Cape of Good Hope rose an estimated 74 percent. The diversion added 10 or more days to delivery times on average (IMF).
The lesson: not every disruption is an event. Some are conditions that last for a year or more. A plan built for a two-week outage does not help when the problem is a permanent 10 days added to every shipment. That is a strategy question for your executives, not a recovery question for your continuity team.
Five Business Continuity Lessons from 2024
- Tier vendors by impact, not spend. The vendor that hurts you most is the one whose failure stops revenue, care, or operations. That is often a small line item. Our guide covers how to bring third parties into your program.
- Exercise with your critical vendors. A questionnaire tells you a vendor has a plan. An exercise tells you whether your plan and theirs fit together. After one joint exercise, I said on Episode 281 that “neither company really knew the details of each other’s business continuity plans.”
- Practice the manual workaround. Synnovis, CDK, and Change Healthcare all forced organizations onto paper. The ones that had practiced it recovered service faster.
- Treat technology outages as business crises. CrowdStrike started in IT, but the decisions that mattered (which locations to restore first, what to tell customers, whether to cancel flights) belonged to the business. Your crisis team should be in the room in the first hour.
- Find your single points of failure before a storm does. One plant. One clearinghouse. One shipping lane. One bridge. If a single failure stops something your business can’t live without, you have a single point of failure, whether or not it shows up on your risk register.
What to Do Before the Next One
Three moves, none of which requires a new budget line:
- Pull your top 10 vendors by impact. For each, write down what stops in the first 24 hours if they go dark, and what you will do instead.
- Run one exercise this quarter where a vendor fails, not you. Take a critical vendor off the map and see who makes the calls. Better still, invite the vendor.
- Check your BIA for concentration. Look for any critical input that comes from one site, one supplier, or one region, and put a decision in front of your executives: accept it, or fund the alternative.
2024 did not invent a new kind of disruption. It showed how many organizations had outsourced their single points of failure without noticing. The next one is already in your supply chain. The only question is whether you find it first.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
- Run the vendor-failure exercise. Exercise in a Day® builds and delivers a full custom tabletop in one business day, including a critical vendor going dark.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your program with us.
