INCIDENT REPORT · CP-2025-008

United Natural Foods (UNFI) cyberattack

L3 · ELEVATEDCONFIRMED

Food wholesaler UNFI, primary distributor to Whole Foods, detected unauthorized activity on its IT systems and took systems offline, disrupting order fulfilment.

Incident ID: CP-2025-008
Incident date: 05 JUN 2025
Detection date: 05 JUN 2025
Affected countries: United States, Canada
Plotted location: Providence, Rhode Island, United States (Affected organization headquarters)
Threat classification: Level 3 — ELEVATED
Classification rationale: Disruption at a major node of the North American grocery supply chain.
Attack type: Infrastructure Compromise
Nature: Malicious activity
Attack vector: Not publicly documented
Sectors: Food & Agriculture, Logistics, Retail
Critical infrastructure: Yes
Organizations affected: United Natural Foods Inc., Whole Foods Market (customer)
Operational consequences: Order fulfilment and distribution were disrupted for weeks, leaving shortages on some retailer shelves; UNFI estimated a $350-400 million reduction in fiscal 2025 net sales. The company has not publicly confirmed ransomware or named an attacker.
Estimated financial impact: $400M — UNFI (July 2025) estimated a $350-400 million reduction in fiscal 2025 net sales and a $50-60 million net income impact before insurance; figure shown is the sales upper bound.
Attribution (as stated): No official attribution recorded

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

United Natural Foods (UNFI) cyberattack

L3 · ELEVATEDCONFIRMED

Food wholesaler UNFI, primary distributor to Whole Foods, detected unauthorized activity on its IT systems and took systems offline, disrupting order fulfilment.

Incident ID

CP-2025-008

Incident date

05 JUN 2025

Detection date

05 JUN 2025

Affected countries

United States, Canada

Plotted location

Providence, Rhode Island, United States (Affected organization headquarters)

Threat classification

Level 3 — ELEVATED

Classification rationale

Disruption at a major node of the North American grocery supply chain.

Attack type

Infrastructure Compromise

Nature

Malicious activity

Attack vector

Not publicly documented

Sectors

Food & Agriculture, Logistics, Retail

Critical infrastructure

Yes

Organizations affected

United Natural Foods Inc., Whole Foods Market (customer)

Operational consequences

Order fulfilment and distribution were disrupted for weeks, leaving shortages on some retailer shelves; UNFI estimated a $350-400 million reduction in fiscal 2025 net sales. The company has not publicly confirmed ransomware or named an attacker.

Estimated financial impact

$400M — UNFI (July 2025) estimated a $350-400 million reduction in fiscal 2025 net sales and a $50-60 million net income impact before insurance; figure shown is the sales upper bound.

Attribution (as stated)

No official attribution recorded