JBS Foods REvil ransomware

On May 30, 2021, JBS S.A., the world's largest meat processor, suffered a REvil ransomware attack that encrypted IT systems supporting plant scheduling, ERP, and production-control functions across operations in the United States, Canada, and Australia. Thirteen US meatpacking plants were idled on June 1, 2021, including major beef-processing facilities in Greeley CO, Cactus TX, Grand Island NE, Ottumwa IA, and Souderton PA. JBS USA CEO Andre Nogueira publicly confirmed on June 9 that the company paid an $11 million ransom in Bitcoin to prevent further disruption and exfiltration. Internal Department of Homeland Security records released later via FOIA revealed JBS's pre-incident cybersecurity to have been characterized as unusually poor, with weak segmentation and credential controls. The FBI publicly attributed the attack to the Russian-speaking REvil (Sodinokibi) ransomware-as-a-service operation on June 2, the same group later responsible for the Kaseya VSA supply-chain attack.

Approximately 22 percent of daily US beef and pork slaughter capacity offline for two days; supply-chain disruption to retail and food-service customers in the US, Canada, and Australia; pork futures spiked during the disruption; $11 million ransom paid; the incident drove USDA and CISA to issue subsequent food-and-agriculture sector cybersecurity guidance.