JBS Foods Ransomware Attack (2021)

On May 30, 2021, JBS Foods was hit by a sophisticated ransomware attack attributed to the REvil (Sodinokibi) group. The attack encrypted servers and systems across JBS's global operations, forcing the shutdown of all JBS-owned beef processing plants in the United States, as well as facilities in Canada and Australia. The disruption threatened a significant portion of the US meat supply, as JBS processes approximately 20% of the nation's meat. After negotiations with the attackers, JBS USA ultimately paid an $11 million ransom in Bitcoin to restore affected systems. The attack highlighted the vulnerability of critical food infrastructure to ransomware and triggered a White House response.

JBS is the world's largest meat processing company, headquartered in Brazil with major operations in the US, Australia, Canada, and Europe. The company processes beef, pork, and lamb for global distribution. The ransomware attack came just weeks after the Colonial Pipeline ransomware attack, heightening concerns about critical infrastructure vulnerabilities.

The REvil group gained access to JBS's network through compromised credentials or exploited vulnerabilities. Ransomware was deployed to encrypt file servers and backup systems. The group used a combination of encryption and data exfiltration to maximize leverage.

MITRE ATT&CK techniques

• T1486

REvil (Sodinokibi) was one of the most prolific Russian-speaking ransomware groups, operating a ransomware-as-a-service (RaaS) model. The group targeted large enterprises globally, demanding multimillion-dollar ransoms.

Aliases

• Sodinokibi

Attribution sources

• FBI Confirmation
• JBS USA Statement
• Media Reports

Additional victims

• US Meat Supply Chain
• Australian Meat Processing Plants
• Canadian Meat Processing Plants

Countries affected

• United States
• Australia
• Canada
• Brazil

Data types

• Corporate Data
• Operational Systems
• Financial Records

$11M ransom paid; additional costs for recovery, lost production, and security upgrades.

Public reaction

The attack caused panic buying and supply concerns in the US. It intensified the national debate about ransomware payments and critical infrastructure protection.

Political impact

The White House directly addressed the attack, and President Biden raised the issue of ransomware with Russian President Putin. It led to increased government focus on food sector cybersecurity.

Geopolitical consequences

The attack strained US-Russia relations as the FBI attributed REvil to Russian-speaking actors. It contributed to the broader diplomatic crisis over ransomware safe havens.

No arrests were made. The FBI investigated but REvil's Russian-based operators were outside US jurisdiction.

Policy changes

• Increased federal cybersecurity requirements for the food and agriculture sector.

Regulatory changes

• TSA issued security directives for pipeline operators similar to those later considered for food processors.

Security improvements

• JBS implemented enhanced network segmentation and backup systems.

Significance

The JBS attack, following Colonial Pipeline, demonstrated that ransomware could disrupt critical food supply chains and force multimillion-dollar ransom payments from essential infrastructure companies.

Legacy

The attack was a wake-up call for the agriculture sector and contributed to the US government's broader crackdown on ransomware groups.

Publishing organisations

• JBS USA

Related events

• Colonial Pipeline DarkSide attack (2021)
• Kaseya REvil attack (2021)

Inspired by

• Colonial Pipeline attack (2021)

Ransom paid. Systems restored over several days. Production resumed.

Official documents

• JBS USA statement (June 2021)

References

1. [1]JBS USA corporate statements
2. [2]FBI confirmation
3. [3]Media reports (Reuters, Bloomberg, CNN)