JBS Foods Ransomware Attack

What happened

On May 30, 2021, JBS S.A., a major global meat processor, was targeted by a ransomware attack that forced the company to halt operations at its beef and pork slaughterhouses in the United States, Canada, and Australia. The disruption threatened to impact meat supplies and prices. The FBI attributed the attack to the Russia-linked cybercriminal group REvil (also known as Sodinokibi). JBS eventually paid an $11 million ransom in Bitcoin to the attackers to ensure no data was exfiltrated and to expedite recovery.

Technical mechanism

The REvil ransomware group gained access to JBS's IT networks, exfiltrated sensitive company data (double extortion), and deployed ransomware to encrypt systems, leading to the operational shutdown.

Why it matters

The attack underscored the vulnerability of global food supply chains to cyber threats and the potential for ransomware to cause significant disruptions in critical agricultural sectors.

Impact

The attack caused temporary closures of all JBS beef facilities in the U.S., impacting roughly one-fifth of the nation's meat supply capacity. JBS paid an $11 million ransom to resolve the incident.

Response

JBS suspended affected systems, notified authorities, and engaged third-party incident response firms. The FBI investigated the incident and formally attributed it to REvil. The White House engaged directly with the Russian government regarding the harboring of ransomware actors.

Defensive lessons

• Critical manufacturing and food supply chains must adopt robust cybersecurity postures, including network segmentation and rapid recovery capabilities.
• The threat of double extortion (data theft combined with encryption) increases the pressure on victims to pay ransoms, necessitating strong data protection controls.

Evidence register

1. Federal Bureau of Investigation (FBI) — FBI Statement on JBS Cyberattack (verified)