April 7, 2026, 3:19 p.m.

"The world's largest meat processing company was unable to produce almost anything for 11 days in June 2021. Result: Global meat prices rose, thousands of employees were sent home."

JBS Foods, a food giant that produces $100 billion worth of meat annually worldwide, with massive facilities in the US, Australia, Canada, and Brazil. In June 2021, this company's entire IT infrastructure was seized by the Russia-linked REVil ransomware group.

JBS Foods: 25% of global meat production halted due to ransomware

How Did the Attack Occur?

REVil is believed to have infiltrated JBS's systems months in advance. By the time the ransom demand came, all of the company's critical systems were already encrypted. Detection mechanisms had failed.

Impact on Global Food Supply

• 🔴 All cattle slaughterhouses in the US shut down completely for 1 day
• 🔴 This represented approximately 25% of US daily cattle capacity
• 🔴 Australian facilities could not produce for several days
• 🔴 Thousands of employees sent home, daily wages could not be paid
• 🔴 Meat supply in supermarkets decreased, prices rose

Ransom: $11 Million

JBS CEO explained the payment decision as follows: "We made this difficult decision to protect our customers and suppliers from potential risks."

• 💸 Ransom paid: $11 million (Bitcoin)
• 💸 FBI advised against payment — but the company paid
• 💸 REVil provided the decryption key after payment

Important note: Paying ransom facilitates attackers' operations and finances the next attack. The FBI does not recommend ransom payments.

Why Is the Food and Manufacturing Sector Targeted?

• When production lines stop, losses accumulate rapidly — pressure to pay ransom becomes enormous
• OT (operational technology) systems are often outdated and unpatched
• When production stops, workers can't receive wages — social pressure also comes into play

Lessons Learned

• ✅ Early detection systems (EDR/XDR): Attackers waited silently in the network for months — monitoring infrastructure to detect this is essential
• ✅ Production and IT network separation: The office network should not have access to the factory network
• ✅ Incident response plan: The answer to "Production stopped, what do we do?" should be prepared in advance
• ✅ Cyber insurance: If a ransom payment decision is to be made, legal and insurance consulting should be obtained

Contact Nordis Global for a manufacturing facility cybersecurity assessment.