By now everyone who reads this has experienced the real-world impacts of cybercrime.
If you’re lucky, maybe it’s just been a few notifications that your personal data has been breached.
Maybe it’s led to longer lines, unexpected temporary closures, or slow service at a hotel or favorite store.
For those less fortunate, this can be doctor appointments or procedures postponed or rescheduled, blocked or unavailable medication, or even critical services paralyzed as their computing systems are hijacked by criminals.
One striking example of such knock-on effects of scale hit last month, when shelves at tens of thousands of grocery stores across America were suddenly empty, like a flashback of the supply chain breakdowns witnessed during the pandemic.
Impacts this time included prescription drugs in some cases, as various services were frozen, reduced to pen-and-paper in some cases, and lasting more than a week.
For the distributor impacted, United Natural Foods, Inc. (UNFI), the damage was deeper, with hundreds of millions in lost sales estimated and a 30% stock plunge as the news spread.
In this week’s PTP Report, we look at this episode and profile the growing trend of cyberattacks targeting the food and agriculture industry. For a sector rife with complex supply chains requiring timely handling, cybercrime incidents can mean not only damages due to delay, but even large-scale spoilage and waste.
A Look at the United Natural Foods Cyberattack
The latest high-profile cyberattack impacting the sector started on June 5, when UNFI became aware they’d been breached.
They enacted their incident response plan, telling CNN: “We have identified unauthorized activity in our systems and have proactively taken some systems offline while we investigate.”
One of America’s largest publicly traded food wholesalers, UNFI makes private label products and ships them to more than 30,000 grocery stores across the US and Canada. And while they’re the primary food distributor for Whole Foods, they also service regional grocers, natural food co-ops, and independent health-food stores.
Their role, which is often invisible to shoppers, was given an unfortunate spotlight when store shelves were suddenly empty, with apologetic notes taped to refrigerators in Texas and Minnesota and vendors without alternatives to offer, as images made the rounds on social media.
And after the company had taken systems offline, they’d reportedly resorted to manual paperwork to keep serving as many customers as possible while they worked with law enforcement.
By June 15, they were once again receiving orders and delivering, but it was three weeks in total before UNFI could release a statement saying the attack had been “contained” and that they were finally able to get back to normal operations.
As with other cyberattacks of this kind, the speed and reach of the real-world impacts were sobering. And as reported by Progressive Grocer’s Marian Zboraj, the company is continuing to monitor the effects that have played out on their business as a result.
Following the event, UNFI suffered reduced sales volume and increased costs as they tried to get food to stores and have also had to deal with additional, direct expenses relating to investigation and the remediation of the attack.
And while they hold cybersecurity insurance, they believe is sufficient for the episode, they expect the fallout to continue well into 2026.
The Growth of Cyber Threats to Our Food Systems
Successful ransomware attack rates go up and down, both in frequency, ransoms paid (and their amounts), and in the overall damages inflicted on both companies and consumers.
But one thing remains consistent: the attacks keep coming.
And per the Food and Agriculture Information Sharing and Analysis Center (Food and Ag-ISAC), their volume in this sector is climbing rapidly, attributed to frequent attackers like CL0P, RansomHub, and Akira.
As with healthcare, there are unique aspects of the US food and agriculture sector that make it particularly appealing for attack.
It is largely privately owned, made up of some 1.9 million farms, over 700,000 restaurants, and more than 220,000 registered facilities for manufacturing, processing, and storage, per stats from the US Cybersecurity and Infrastructure Security Agency (CISA).
This rich and varied tapestry also means inconsistency in defense, presenting a variety of attack surfaces with varying levels of sophistication and coverage.
And as we witnessed with customer response to the UNFI attack, food is a vital service for everyone, making disturbances to its availability able to rapidly trigger panic.
This event can be compared to other recent examples of high-profile ransomware attacks in food distribution in recent years.
The Dole Ransomware Attack
It should be noted that the UNFI attack has yet to be confirmed as ransomware, though it displays all the usual signs.
A similar episode impacted Dole Foods in 2023, forcing them to shut down production plants in the US and stop shipping food to stores.
Damages in this case were reported at $10.5 million in direct costs, before insurance.
This followed a ransomware attack on the world’s largest meat supplier, JBS, which closed factories in the US, Canada, and Australia. In that case, JBS paid $11 million in ransom to unlock their systems.
It can be seen as part of an escalating trend in the cost of these attacks.
Sam’s Club Data Breach
In late March, warehouse-club vendor and Walmart division Sam’s Club began investigating claims by ransomware gang CL0P that they’d been breached.
The gang posted Sam’s Club to its leak site, though there has yet to be evidence of stolen data being verified.
Reporting by Bleeping Computer pegged the attack to a January wave of attacks that exploited a zero-day vulnerability in the Cleo secure file transfer software which itself got patched in October.
This is not the first time Sam’s Club has been impacted by cyberattacks, with a credential-stuffing incident in 2020 leading to the notification of customers that accounts had been compromised.
The Ahold Delhaize Cybersecurity Incident
Last November, grocery chains themselves were hit by an attack credited to the ransomware group INC Ransom. And like the UNFI episode, this resulted in empty grocery store shelves.
Dutch-Belgian multinational retailer Ahold Delhaize (parent of store chains like Food Lion, Stop & Shop, Hannaford, and Giant Food and the fourth largest food retailer in the US) was back in the news last month when they disclosed that this attack also resulted in a massive data breach: the leaking of personal data from some 2 million customers. This includes social security numbers, bank account numbers, and even health information.
The notification of this piece came seven months after the actual attack, demonstrating not only how long it can take to process and resolve attacks, but also the possibility of lingering damages.
The Cost of Food Supply Chain Risks and Failure in Critical Infrastructure Cybersecurity
These episodes illustrate some of the difficulty in protecting food creation, distribution, and retail.
In the case of UNFI, Kingdom Capital estimates their loss in sales alone may fall between $300–500 million (translating to some estimated $25–50 million in lost gross profit), and while some may be resolved in backorder, many were lost forever.
There’s also spoilage from products that couldn’t get to their destination in time, ongoing IT costs, and the hit to their stock price (which lost as much as 30% after the attack).
This doesn’t include additional damage to the brand’s reputation, both among other businesses and customers, or later the possibility of additional fallout such as the kind experienced by Ahold Delhaize.
Tightening Cybersecurity in Logistics and Food
As with large incidents in the medical field (such as Change Healthcare), episodes like this demonstrate the real-world impact of cyberattacks and lead to public discussions about what can be done to protect our food supply.
Solutions all point to the necessity of sector cybersecurity throughout the supply chain, alongside the physical demands of making, processing, and delivering food on time.
CISA lays out four steps in their Food and Agriculture Cybersecurity Checklist to start with:
- Use strong passwords
- Require multi-factor authentication (MFA)
- Spot and report phishing
- Update software
None of these is too surprising, and at PTP we’ve been promoting them for years in our cybersecurity roundups.
Still, following these four steps alone could prevent many of the ransomware attacks that keep making news across industries.
But when the inevitable breaches do happen, the better your intrusion detection, cybersecurity expertise, and incident response planning is, the faster criminals can be stopped, or limited in their ability to move laterally, exfiltrate data, and install malware.
Approaches like utilizing a Zero Trust Architecture can ensure more segmentation and scrutiny on system users, with less freedom for intruders to move and manipulate systems.
At PTP, we believe one of the single best ways to improve all aspects of defense (affordably) is through employee training and cybersecurity culture.
But still, despite all of this, supply chains that rely on a single component remain vulnerable. The more adaptable and diversified the network, the more easily grocery stores, for example, can adapt to failures in-line.
Cybersecurity is no longer a perimeter that a single company can enact to protect themselves and their customers. It extends throughout third-party partnerships and across a myriad of surfaces and devices.
PTP and Food Industry Cybersecurity
Is your company prepared for a ransomware attack?
How about one that occurs to one of your partners, providers, or end clients?
If the answer is no (or “sort of”), consider hiring cybersecurity pros from PTP.
With more than 27 years of experience finding, vetting, and providing the best talent onsite or off, we can help you fill your greatest areas in the way, and at the cost, you need.
Conclusion
Attacks on the food supply certainly aren’t new. But with long, complex supply chains that see more and more surfaces online and available for attack, the form and variety of risks continue to intensify.
Cyberattacks on the food supply chain aren’t going to diminish, but like attacks on other essential aspects of society, from healthcare to utility services, they’re becoming more inventive and insidious all the time.
And as the UNFI attack showed most recently, protecting the food industry from hackers is about more than just profits and reputation. It’s about keeping food on shelves and in kitchen cupboards.
References
Whole Foods’ primary distributor forced to shut down its systems after a major cyberattack and Cyberattack on food giant Dole temporarily shuts down North America production, company memo says, CNN
Cyberattack on grocery supplier reveals fragility of U.S. and Minnesota’s food supply, Minnesota Star Tribune
Retail giant Sam’s Club investigates Clop ransomware breach claims, Bleeping Computer
Ahold Delhaize USA confirms 2M+ victims affected by 2024 cyberattack, Cyber News
Food and Agriculture Cybersecurity Checklist and Resources, CISA
The Ahold Delhaize USA Breach: How a Single Click Can Cost Millions, Cyber Defense Magazine
Farm-to-Table Ransomware Realities: Q1 2025 Analysis, Food & Ag ISAC
UNFI Back to Normal Operations After Cyberattack, Progressive Grocer
United Natural Foods says cyberattack will reduce quarterly earnings, Cybersecurity Dive
United Natural Foods Unjustly Flattened By Cyber Event, Kingdom Capital
FAQs
How big is the cybercrime problem in the food sector?
The food sector is one of the fastest-growing targets among critical infrastructure sectors. While the UNFI attack may serve as a wake-up call for many, it’s not new and growing rapidly.
Per the Food and Ag ISAC Q1 2025 Analysis, there were 84 registered attacks in Q1 of 2025 alone, following 212 in 2024 and 167 reported from 2023.
Why do criminals go after food companies instead of banks, for example?
Food is critical for everyone, and changes in its supply elicit strong reactions. It’s also very time-sensitive, with even minor delays triggering damage to products or even spoilage and waste.
Add to this the increasingly digital, online nature of the supply chain and the reliance on core components, and criminals can find wildly varying sophistication in defenses with potentially large payoffs.
How can companies in this industry with varying budgets best manage the risks?
CISA recommends starting with four simple things: strong passwords, MFA, awareness and reporting of phishing, and prompt updating of systems.
In addition to this, quality cybersecurity training for everyone and the establishment of a culture of security can make an enormous difference.
And as always, having talented, experienced professionals is critical.
