Cyberattack shutdown: what happened at Brazilian meat supplier JBS

The largest meat processing company in the world, JBS, was in May the target of a cyberattack that affected servers supporting its North American and Australian IT systems.

The company raced to suspend the affected systems, but was forced to halt operations at its US slaughterhouses and stand down 7,000 workers in Australia without pay.

The shutdown reduced the number of cattle and pigs slaughtered, causing a shortage in US meat supply and driving up wholesale meat prices as much as 25%, according to cited FBI data.

JBS USA in June confirmed it paid the equivalent of $11m in ransom to free up its systems. “This was a very difficult decision to make,” said company CEO Andre Nogueira. “However, we felt this decision had to be made to prevent any potential risk for our customers.”

The more than $200m annual IT spend and 850-strong global IT team at JBS counted for little against such a formidable invader.

In the wake of the attack, the FBI issued a notice to the food sector warning it was being “increasingly targeted” and revealed several attacks this year. Among them was an anonymous farm suffering losses of $9m due to a temporary shutdown of operations and a US bakery that lost access to its server, files, and applications – halting production, shipping, and receiving for a week.

No one is safe, the FBI warned. “Larger businesses are targeted based on their perceived ability to pay higher ransom demands, while smaller entities may be seen as soft targets, particularly those in the earlier stages of digitising their processes,” it noted.

The attack on JBS and the resulting disruption will have inspired other hacking groups to focus on the sector, says Pascal Geenens, director of threat intelligence at Radware. “Since the JBS incident and the media coverage it received, attackers have become aware of the criticality in food supply and how an attack on one of the links in the chain can disrupt the whole chain and cause social impact,” Geenens says. “This attack has raised the stakes and I expect we will see ransom operators exploit it even more.”