United Natural Foods fulfilling orders on \u2018limited basis\u2019 in wake of cyberattack | CyberScoop<\/title> <meta name=\"description\" content=\"CEO Sandy Douglas said the food distributor is helping some customers maintain inventory with assistance from other wholesalers.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/united-natural-foods-cyberattack-recovery\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"United Natural Foods fulfilling orders on \u2018limited basis\u2019 in wake of cyberattack\"> <meta property=\"og:description\" content=\"CEO Sandy Douglas said the food distributor is helping some customers maintain inventory with assistance from other wholesalers.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/united-natural-foods-cyberattack-recovery\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2025-06-10T19:46:51+00:00\"> <meta property=\"article:modified_time\" content=\"2025-06-10T19:46:54+00:00\"> <meta name=\"author\" content=\"Matt Kapko\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack-2.jpg\"> <meta name=\"twitter:creator\" content=\"@CyberScoopNews\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1746040294g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1748637685g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1748220166g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=13897d660a0ac2c9c7d1\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/84848\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.8.1\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=84848\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Funited-natural-foods-cyberattack-recovery%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Funited-natural-foods-cyberattack-recovery%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"wp-singular post-template-default single single-post postid-84848 single-format-standard wp-theme-scoopnewsgroup wp-child-theme-cyberscoop\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/united-natural-foods-cyberattack-recovery\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"4.9180327868852\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Voting is open for the 2025 CyberScoop 50 awards!<\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"24.954810495627\">\n<div class=\"single-article__header-content\" readability=\"30.380952380952\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/united-natural-foods-cyberattack-recovery\/\"> <span>Cybercrime<\/span> <\/a> <\/li>\n<\/ul>\n<p> CEO Sandy Douglas said the food distributor is helping some customers maintain inventory with assistance from other wholesalers. <\/p>\n<p>   <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"388\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack.jpg?resize=640%2C388&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt=\"Abstract of interior of supermarket corridor.\" decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack-2.jpg 5463w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack-2.jpg?resize=300,182 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack-2.jpg?resize=768,466 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack-2.jpg?resize=1024,622 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack-2.jpg?resize=1536,932 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack-2.jpg?resize=2048,1243 2048w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack-2.jpg?resize=600,364 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack-2.jpg?resize=277,168 277w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack-2.jpg?resize=555,337 555w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack-2.jpg?resize=1112,675 1112w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack-2.jpg?resize=1389,843 1389w\" sizes=\"(max-width: 1112px) 100vw, 1112px\"><figcaption> Abstract of interior of supermarket corridor. (Chainarong Prasertthai \/ Getty Images Plus) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"35.17659137577\"><body readability=\"72\"><\/p>\n<p>United Natural Foods\u2019 operations remain significantly impacted by a cyberattack that prompted the company to <a href=\"https:\/\/cyberscoop.com\/united-natural-foods-whole-foods-distributor-cyberattack\/\">completely shut its network down<\/a> last week, executives said Tuesday.<\/p>\n<p>The food distributor and wholesaler is fulfilling some customers\u2019 orders on a limited basis, depending on the technology platform involved, and some customers are maintaining inventory with help from other wholesalers, CEO Sandy Douglas said on the company\u2019s earnings call for its <a href=\"https:\/\/ir.unfi.com\/news\/press-release-details\/2025\/United-Natural-Foods-Inc--Reports-Third-Quarter-Fiscal-2025-Results\/default.aspx\">fiscal year 2025 third quarter<\/a>, which ended May 3.<\/p>\n<p>Douglas declined to describe the company\u2019s current operation levels on a percentage basis. United Natural Foods operates 52 distribution centers that fulfill about 250,000 products from more than 11,000 suppliers to 30,000 customer locations in North America. The company is also Whole Foods Market\u2019s primary food distributor.<\/p>\n<p>\u201cHow we work together with customers in a crisis, in some ways, is a defining opportunity for us,\u201d Douglas said. \u201cUntil we reach a point of functional equilibrium, and when our systems are safe and operating as they should, we have to focus on existing customers and meeting their needs with every ounce of our energy, and that\u2019s what we\u2019re doing.\u201d<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>United Natural Foods declined to update its financial outlook, due to the ongoing assessment of the cyberattack\u2019s impact, and Douglas said it\u2019s too early to quantify financial impact from the attack.<\/p>\n<p>Costs associated with the recovery include the company\u2019s efforts to mitigate and resume operations, and additional work underway across sales, supply chain and procurement to assist suppliers and customers. <\/p>\n<p>\u201cI would also caution everyone not to make assumptions about the length of the issue,\u201d Douglas said in response to an analyst\u2019s question. <\/p>\n<p>The attack on United Natural Foods follows a wave of ransomware and extortion attacks on retailers and grocery stores in the United Kingdom in April. Security researchers attributed the attack spree to the cybercrime collective Scattered Spider, which last month shifted its focus to U.S.-based retailers in early May. <\/p>\n<p>The circumstances of the attack on United Natural Foods bear similarities and follow the pattern of recent Scattered Spider activities, but researchers have yet to attribute the attack on the food distributor to a specific threat group.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>United Natural Foods said it discovered the intrusion on Thursday and, upon investigation, decided to shut its systems down late Friday. The company filed a <a href=\"https:\/\/d18rn0p25nwr6d.cloudfront.net\/CIK-0001020859\/03a307f1-6da4-47b3-88ab-1a2a39d45b30.pdf\">regulatory filing<\/a> about the incident Monday morning before markets opened.<\/p>\n<p>Executives described the company\u2019s cybersecurity investments as significant, and said the attack puts additional focus on areas of potential defense improvements. <\/p>\n<p>\u201cI think a company needs to be both high capability and humble when it relates to cybersecurity, and this event is just a demonstrated example of why,\u201d Douglas said.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"3.6742268041237\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack-1.jpg?w=640&ssl=1\" alt=\"Matt Kapko\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Matt Kapko<\/h4>\n<p> Matt Kapko is a reporter at CyberScoop. His beat includes cybercrime, ransomware, software defects and vulnerability (mis)management. The lifelong Californian started his journalism career in 2001 with previous stops at Cybersecurity Dive, CIO, SDxCentral and RCR Wireless News. Matt has a degree in journalism and history from Humboldt State University. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/united-natural-foods-cyberattack-recovery\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>United Natural Foods fulfilling orders on \u2018limited basis\u2019 in wake<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[413,282,78,1437,1813,1866,4405],"tags":[415,286,86,1440,1814,1868,4406],"class_list":["post-7725","post","type-post","status-publish","format-standard","hentry","category-critical-infrastructure","category-cybercrime","category-cybersecurity","category-food-security","category-supply-chain","category-supply-chain-attacks","category-whole-foods","tag-critical-infrastructure","tag-cybercrime","tag-cybersecurity","tag-food-security","tag-supply-chain","tag-supply-chain-attacks","tag-whole-foods"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/critical-infrastructure\/\" rel=\"category tag\">critical infrastructure<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/food-security\/\" rel=\"category tag\">food security<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/supply-chain\/\" rel=\"category tag\">supply chain<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/supply-chain-attacks\/\" rel=\"category tag\">supply chain attacks<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/whole-foods\/\" rel=\"category tag\">Whole Foods<\/a>","tag_info":"Whole Foods","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=7725"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7725\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=7725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=7725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=7725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":7725,"date":"2025-06-10T14:46:51","date_gmt":"2025-06-10T19:46:51","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=84848"},"modified":"2025-06-10T14:46:51","modified_gmt":"2025-06-10T19:46:51","slug":"united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/06\/10\/united-natural-foods-fulfilling-orders-on-limited-basis-in-wake-of-cyberattack\/","title":{"rendered":"United Natural Foods fulfilling orders on \u2018limited basis\u2019 in wake of cyberattack"},"content":{"rendered":"