INCIDENT REPORT · CP-2021-004
JBS Foods ransomware attack
L3 · ELEVATEDCONFIRMED
On 30 May 2021, JBS USA, part of the world's largest meat processor, found it was the target of an organized cyberattack. The attack affected servers supporting its North American and Australian IT systems.
- Incident ID
- CP-2021-004
- Incident date
- 30 MAY 2021
- Detection date
- 30 MAY 2021
- Affected countries
- United States, Australia, Canada
- Plotted location
- Greeley, United States (Affected organization headquarters (JBS USA))
- Threat classification
- Level 3 — ELEVATED
- Classification rationale
- Major food-supply company disrupted across multiple countries; operations recovered within days.
- Attack type
- Ransomware
- Nature
- Malicious activity
- Attack vector
- Not publicly documented
- Sectors
- Food & Agriculture
- Critical infrastructure
- Yes
- Organizations affected
- JBS USA, JBS Australia
- Operational consequences
- JBS suspended affected systems and meat processing operations were disrupted, including a shutdown of Australian operations. JBS USA said it paid the equivalent of $11 million in ransom.
- Estimated financial impact
- Ransom of ~$11m stated by JBS USA (CEO Andre Nogueira); total incident cost not disclosed.
- Attribution (as stated)
- Attributed by the FBI to REvil (Sodinokibi)
SOURCE REFERENCES
- [1] JBS USA Cyberattack Media Statement – May 31JBS · jbsfoodsgroup.com · 31 MAY 2021
- [2] JBS paid $11 million to resolve ransomware attackCybersecurity Dive · cybersecuritydive.com
- [3] Meat Supplier JBS Paid Ransomware Hackers $11 MillionNBC News · nbcnewyork.com
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.