World's biggest meat supplier is latest prey to cybersecurity attack

The world’s biggest meat supplier has become the latest casualty of a cybersecurity attack, posing a new threat to global food supply chains already rattled by the Covid-19 pandemic.
 

JBS SA shut its North American and Australian computer networks after an organized assault on Sunday on some of its servers, the company said by email. Without commenting on operations at its plants, JBS said the incident may delay certain transactions with customers and suppliers.

The attack sidelined two shifts and halted processing at one of Canada’s largest meatpacking plants, while in Australia the company canceled all beef and lamb kills across the nation, according to industry website Beef Central. There were no immediate reports of plant disruptions in the U.S.

Hackers have the commodities complex in their crosshairs with the JBS attack coming just three weeks after the operator of the biggest U.S. gasoline pipeline was targeted. It’s also happened as the global meat industry battles lingering Covid-19 absenteeism after recovering from mass outbreaks last year that saw plants shut and supplies disrupted.

Canadian facility
 

The cyber assault affected a Canadian beef plant in Brooks, Alberta, about 190 kilometers (118 miles) east of Calgary, on Monday, according to Scott Payne, spokesman for United Food and Commercial Workers Canada Union Local 401. The facility accounts for more than a quarter of the nation’s capacity, and according to a job ad, processes about 4,200 head of cattle a day.

“There are no unionized workers there,” Payne said in a phone interview. “That means effectively the plant’s operations have shut for the day.” JBS didn’t respond to requests for comment on the Canadian closure.

Read More: 'They hit you hard': How DarkSide became powerhouse of ransomware attacks

A JBS packaging facility in Belleville, Ontario, where beef, pork and salmon are prepared for grocery stores, was operating normally, said Tim Deelstra, a spokesman for UFCW Canada Local 175. Dakar Lanzino, an external UFCW representative, said he had no information on whether the attack had disrupted plants in the U.S. on Monday, a public holiday.

Sao Paulo-based JBS owns facilities in 20 countries. Australia and New Zealand account for 4% of the company’s revenue, while the U.S. represents 50% and Canada 3%, according to company fillings. The company also has operations in South America and Europe.

Backup Servers Fine
 

Backup servers were not affected, and the company is actively working to restore systems as soon as possible, according to a statement from JBS USA Monday. The processor said it’s not aware of any customer, supplier or employee data being compromised or misused.

A ransom-ware attack forced Colonial Pipeline Co. to stop the flow of fuel for several days in May, causing severe gasoline shortages.

In Australia, JBS is the largest meat and food processor with a portfolio of beef, lamb, pork, and value-added branded products, according to its website. It exports to more than 50 countries.

The shutdown is a big concern for meat exports if it drags on, said Matt Dalgleish, manager of commodity markets insights at Thomas Elder Markets, noting Australia ships overseas about 70%-75% of red meat products from sheep and cattle. There is a risk to worldwide supplies too. “Given the size of JBS globally, if they were offline for any more than a week, then we’re going to see disruption to supply chains for sure,” he said.

Russian group is key suspect
 
A notorious Russia-linked hacking group is behind the cyberattack against JBS, according to four people familiar with the assault. The cyber gang goes by the name REvil or Sodinokibi. While it’s unclear if all of REvil’s hackers operate in Russia, the group’s public face, a user on the dark web cyber-crime forum XSS who goes by the name “Unknown”, exclusively publishes in Russian.