Food · 2021
JBS: ransomware halted meat production
A quarter of US beef capacity, offline for a ransom.
What happened
On May 30, 2021, ransomware disrupted JBS operations in North America and Australia. Every US beef plant temporarily closed, Australian processing stopped and a major Canadian facility was idled. Most operations returned within one or two days, but the event showed how quickly a corporate-system outage can reach physical production and food supply.
The FBI attributed the attack to REvil. Security researchers also found employee credentials exposed online, an attempted Remote Desktop connection and unusual outbound data transfers before the ransomware was deployed. Together, those signals show an attack developing before the final encryption event, and the value of detecting compromised identities before they reach production.
JBS paid $11M in bitcoin even though most plants were already operating. The company said the payment was intended to reduce further disruption and prevent data exposure.
What would have changed it
Operational resilience must include the systems around the production line, not only the machinery on it. We monitor continuously and test how the business will run during isolation and recovery.