JBS S.A. ransomware attack

JBS S.A., a Brazil-based meat processing company, supplies approximately one-fifth of meat globally, making it the world's largest producer of beef, chicken, and pork by sales.[1] The attack was compared to the Colonial Pipeline cyberattack, which occurred earlier in the same month.[2]

An employee of Recorded Future referred to the attack as the largest to date to impact a company focused on food production.[3] Some forty additional attacks on food producers occurred in the twelve months preceding the JBS attack, with targets including beverage company Molson Coors.[3]

All facilities belonging to JBS USA, JBS' American subsidiary, including those focused on pork and poultry, faced disruption due to the attack.[4] All JBS-owned beef facilities in the United States were rendered temporarily inoperative.[4] Impacted slaughterhouses were located in states including Utah, Texas, Wisconsin, and Nebraska. A notable shutdown was the JBS beef facility in Souderton, Pennsylvania, which is the largest such facility east of Chicago, according to JBS.[5]

The beef industry in Australia faced disruption as a result of the attack.[6] JBS "stood down" some 7000 Australian employees on June 2.[7]

The U.S. Department of Agriculture was unable to offer wholesale beef and pork prices on June 1.[8] Due to predicted shortfalls in meat production and price increases, the USDA encouraged other companies to increase production.[9] JBS indicated on June 1 that most of its facilities would resume functioning on June 2.[10] The attack heightened awareness of consolidation in the meatpacking industry in the United States, and the corresponding vulnerability to decreased production, should one of the four major meat producers reduce its output.[11]

JBS paid the hackers an $11 million ransom.[12] The ransom was paid in Bitcoin.[13] American politician Carolyn Maloney criticized the company for paying the ransom due to concerns it might incentivize further attacks.[14] The attack brought attention to the potentially negative consequences of consolidation in meat production.[15]

The White House announced that the cyberattack was likely conducted by a Russian organization,[7] and news outlets reported that REvil was culpable.[16] As of June 2, REvil had not taken credit for the attack,[17] and the FBI was conducting an investigation into its origins.

After a 9 July 2021 phone call between United States president Joe Biden and Russian president Vladimir Putin, Biden told the press, "I made it very clear to him that the United States expects when a ransomware operation is coming from his soil even though it’s not sponsored by the state, we expect them to act if we give them enough information to act on who that is." Biden later added that the United States would take the group's servers down if Putin did not.[18][19]

On 13 July 2021, REvil websites and other infrastructure vanished from the internet.[20]