Cyberattack Forces Whole Foods Supplier to Shut Down Network Operations

Major Cyber Breach Disrupts America’s Largest Natural Foods Distributor, Threatening Whole Foods Supply Chain

Three Key Facts

• United Natural Foods (UNFI), North America’s largest publicly traded wholesale distributor serving over 30,000 locations with $31 billion in annual revenue, suffered a major cyberattack on June 5 that forced the company to shut down its entire network by Friday afternoon
• The cyberattack caused UNFI stock to plummet over 9%, erasing prior gains and forcing the company to withdraw its full-year financial guidance, now projecting a net loss of $55-80 million compared to previous estimates of a $13 million loss to $3 million profit
• The incident highlights the vulnerability of critical food distribution infrastructure, with UNFI operating 50+ distribution centers and managing over 250,000 products that supply major retailers including Amazon’s Whole Foods

Introduction

A sophisticated cyberattack has crippled the operations of United Natural Foods, the primary distributor for Amazon’s Whole Foods, forcing the company to take critical IT systems offline and disrupting grocery supply chains across North America. The Rhode Island-based distributor discovered unauthorized activity on June 5 and responded by shutting down its entire network within 24 hours as a precautionary measure.

The attack strikes at the heart of America’s food distribution infrastructure. UNFI operates as North America’s largest full-service grocery partner, managing more than 250,000 products across 50 distribution centers and serving over 30,000 retail locations. The company’s vast network generates more than $31 billion annually and employs over 28,000 people, making any disruption to its operations a significant concern for food security and supply chain stability.

Key Developments

UNFI detected the security breach on Thursday and implemented its incident response plan immediately. According to SecurityWeek, the company engaged third-party cybersecurity experts and notified law enforcement while working to assess the scope and impact of the unauthorized activity.

The distributor’s response was swift but comprehensive. Management shut down the entire network by Friday afternoon, taking external-facing systems offline including web platforms used by suppliers and customers, as well as VPN products. This decisive action, while disruptive, aimed to prevent further compromise and contain potential damage.

The company has implemented workarounds to maintain limited service levels and is fulfilling orders on a restricted basis. UNFI spokesperson Inès de Miranda emphasized that customers, suppliers, and associates remain the highest priority as the company works to safely restore systems.

Market Impact

Financial markets reacted severely to news of the cyberattack. UNFI shares fell 6.98% on Monday following the initial disclosure, with losses extending beyond 9% as the full scope of the incident became apparent. The stock decline erased previous gains and pushed shares into negative territory for the year.

The company withdrew its full-year financial guidance, citing uncertainty about the incident’s complete impact. UNFI now projects a net loss ranging from $55 million to $80 million for the year, a dramatic revision from earlier estimates of a $13 million loss to a potential $3 million profit. Per-share losses are expected to range from $0.90 to $1.30, compared to the previous forecast of a $0.15 loss to a $0.05 gain.

Retail partners are experiencing tangible effects from the disruption. Reports indicate diminished inventory and empty shelves at some affected stores, though the company has not confirmed whether these shortages stem directly from the cyberattack or broader supply chain challenges.

Strategic Insights

The incident occurs against a backdrop of escalating cyber threats targeting retail and food distribution networks. Recent warnings from Google highlighted increased cyber threats aimed at US retailers, following similar attacks on UK retailers in previous weeks. Ransomware incidents surged 46% in the first quarter alone, with 2,472 new victims reported.

CEO Sandy Douglas framed the crisis as an opportunity to strengthen customer relationships and demonstrate resilience. During the earnings call, he emphasized that UNFI uses multiple external benchmarks to assess cybersecurity defenses and is examining enhancements to bolster security posture.

The attack exposes the vulnerability of interconnected food distribution systems that rely heavily on digital infrastructure for logistics, inventory management, and transactions. Steve Cobb, CISO at SecurityScorecard, noted that interruptions in food distribution can cascade into wider supply chain disruptions.

Expert Opinions and Data

Despite operational challenges, UNFI reported strong third-quarter financial performance before the cyberattack’s impact. Net sales rose 7.5% year-over-year to $8.06 billion, driven by a 4% increase in wholesale unit volumes and growth in natural product sales. Gross profit increased 6.1% to $1.1 billion, while adjusted EBITDA reached $157 million compared to $130 million in the previous year.

Douglas highlighted the company’s progress toward three-year fiscal 2027 objectives, noting initiatives in network optimization and working capital efficiency. UNFI has exceeded its goal of generating up to $100 million in free cash flow during fiscal 2025 and may surpass this target by over 50%.

Industry experts view the incident as a wake-up call for supply chain cybersecurity. The financial impact encompasses both direct costs including losses and remediation expenses, and indirect effects such as reputational damage and lost business relationships. The disruption demonstrates that cybersecurity has evolved from an IT concern to a core business risk affecting operational continuity.

While no ransomware group has claimed responsibility for the attack, security professionals suspect this type of operation based on the response pattern and system shutdowns. The incident aligns with recent activities by threat actors including Scattered Spider and DragonForce ransomware operations that have shifted focus to US companies.

Conclusion

The cyberattack on United Natural Foods represents a significant disruption to North America’s food distribution infrastructure, affecting thousands of retail locations and millions of consumers. The incident’s financial impact extends beyond immediate operational costs to include substantial revisions in corporate guidance and shareholder value destruction.

UNFI’s response demonstrates both the complexity of modern supply chain cybersecurity and the critical importance of incident response planning. The company’s ability to implement workarounds while systematically restoring systems shows operational resilience, though the full recovery timeline remains uncertain. The attack serves as a stark reminder of the systemic risks posed by cyber threats to essential services and highlights the need for enhanced security measures across the food distribution sector.