United Natural Foods loses up to $400M in sales after cyberattack | CyberScoop<\/title> <meta name=\"description\" content=\"The food distributor and wholesaler completely shut down its systems upon discovering the attack last month, yet core systems were restored and normal operating capacity returned within three weeks.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/united-natural-foods-cyberattack-400-million\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"United Natural Foods loses up to $400M in sales after cyberattack\"> <meta property=\"og:description\" content=\"The food distributor and wholesaler completely shut down its systems upon discovering the attack last month, yet core systems were restored and normal operating capacity returned within three weeks.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/united-natural-foods-cyberattack-400-million\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2025-07-17T21:37:53+00:00\"> <meta property=\"article:modified_time\" content=\"2025-07-17T21:37:56+00:00\"> <meta name=\"author\" content=\"Matt Kapko\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack-2.jpg\"> <meta name=\"twitter:creator\" content=\"@CyberScoopNews\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1752617955g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1752617143g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1752075323g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=13897d660a0ac2c9c7d1\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/85231\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.8.2\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=85231\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Funited-natural-foods-cyberattack-400-million%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Funited-natural-foods-cyberattack-400-million%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"wp-singular post-template-default single single-post postid-85231 single-format-standard wp-theme-scoopnewsgroup wp-child-theme-cyberscoop\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/united-natural-foods-cyberattack-400-million\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"4.9180327868852\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Voting is open for the 2025 CyberScoop 50 awards!<\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"26.41431670282\">\n<div class=\"single-article__header-content\" readability=\"35.380743982495\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/united-natural-foods-cyberattack-400-million\/\"> <span>Cybercrime<\/span> <\/a> <\/li>\n<\/ul>\n<p> The food distributor and wholesaler completely shut down its systems upon discovering the attack last month, yet core systems were restored and normal operating capacity returned within three weeks. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/85231\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"444\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack.jpg?resize=640%2C444&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack-2.jpg 4032w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack-2.jpg?resize=300,208 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack-2.jpg?resize=768,533 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack-2.jpg?resize=1024,710 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack-2.jpg?resize=1536,1066 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack-2.jpg?resize=2048,1421 2048w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack-2.jpg?resize=600,416 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack-2.jpg?resize=242,168 242w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack-2.jpg?resize=486,337 486w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack-2.jpg?resize=973,675 973w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack-2.jpg?resize=1215,843 1215w\" sizes=\"(max-width: 973px) 100vw, 973px\"><figcaption> A shelf is seen bare in the frozen foods section of a Whole Foods store on June 11, 2025 in San Rafael, California. United Natural Foods, the primary food distributor to Whole Foods, paused deliveries to Whole Foods stores after a cyberattack crippled its system. Some Whole Foods stores are experiencing empty shelves and freezers. The company said this week that the attack will cost them up to $400 million in lost sales. (Photo by Justin Sullivan\/Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"36.87147505423\"><body readability=\"74.827960322381\"><\/p>\n<p>United Natural Foods said the cyberattack that prompted the food distributor and wholesaler to <a href=\"https:\/\/cyberscoop.com\/united-natural-foods-whole-foods-distributor-cyberattack\/\">completely shut down its network last month<\/a> resulted in <a href=\"https:\/\/ir.unfi.com\/news\/press-release-details\/2025\/United-Natural-Foods-Inc--Provides-Business-Update\/default.aspx\">lost sales of up to $400 million<\/a>. Executives, during a business update call Wednesday with analysts and investors, said the financial impact from the attack is largely contained to the current quarter, which ends in early August.<\/p>\n<p>The operational interruption caused by the cyberattack, which the company discovered June 5 and disclosed four days later, will result in a net income loss of up to $60 million. Executives did not mention a ransom demand or payment during the call.<\/p>\n<p>The attack on Whole Foods Market\u2019s primary distributor was part of an ongoing attack spree linked to <a href=\"https:\/\/cyberscoop.com\/scattered-spider-social-engineering-cybercrime\/\">Scattered Spider<\/a>, a financially motivated cybercrime collective that\u2019s hit dozens of companies in the retail, insurance and aviation industries since it regrouped earlier this year.<\/p>\n<p>The orders United Natural Foods was unable to fill \u2014 resulting in empty store shelves and spoilage in the wake of the attack \u2014 shows the wide financial impact of cybercrime. The company operates 52 distribution centers that fulfill about 250,000 products from more than 11,000 suppliers to 30,000 customer locations in North America.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cBecause of the unique role UNFI plays in the food-supply chain, we recognize that this cyber incident impacted our customers and the industry we serve. We never want to be the reason that a local grocer is out of stock on a product that their shoppers count on,\u201d CEO Sandy Douglas said during the call.<\/p>\n<p>Direct costs related to the attack include an estimated $20 million incurred as the company used manual workarounds while systems were offline, and $5 million for remediation costs, including third-party cybersecurity, legal and governance experts brought in to assist with response and recovery efforts.<\/p>\n<p>United Natural Foods expects its cyber insurance policy to sufficiently offset those recovery and remediation costs, but noted that reimbursement will likely arrive in fiscal year 2026, which starts in August.<\/p>\n<p>Meantime, the company has mostly recovered and returned to normal operations. \u201cAs of this week, our commercial operating capacity has been restored to normalized levels, average outbound fill rates, on-time deliveries and units shipped are at or close to pre-incident levels, with some variation across distribution centers. We expect continued improvement as we complete our recovery in the coming weeks,\u201d Douglas said.<\/p>\n<p>United Natural Foods restored its primary electronic ordering systems June 16, 10 days after it took systems down, Douglas added. While the restoration is ongoing for some less critical tools, including customized reporting platforms, the company has achieved the bulk of its recovery requirements.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cBy June 26 we had safely restored our core systems and broadly returned to more normal operating capacity across our distribution network,\u201d Douglas said. \u201cSince then, we\u2019ve continued working closely with our customers and suppliers to catch up on various business processes, including purchase orders, invoicing and payments that were temporarily delayed during the disruption period.\u201d<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"3.8655097613883\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/07\/united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack-1.jpg?w=640&ssl=1\" alt=\"Matt Kapko\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Matt Kapko<\/h4>\n<p> Matt Kapko is a reporter at CyberScoop. His beat includes cybercrime, ransomware, software defects and vulnerability (mis)management. The lifelong Californian started his journalism career in 2001 with previous stops at Cybersecurity Dive, CIO, SDxCentral and RCR Wireless News. Matt has a degree in journalism and history from Humboldt State University. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/united-natural-foods-cyberattack-400-million\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>United Natural Foods loses up to $400M in sales after<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[413,282,78,679,281,46,4592,288],"tags":[415,286,86,680,285,54,4593,294],"class_list":["post-7811","post","type-post","status-publish","format-standard","hentry","category-critical-infrastructure","category-cybercrime","category-cybersecurity","category-financial","category-hacking","category-ransomware","category-retail","category-threats","tag-critical-infrastructure","tag-cybercrime","tag-cybersecurity","tag-financial","tag-hacking","tag-ransomware","tag-retail","tag-threats"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/critical-infrastructure\/\" rel=\"category tag\">critical infrastructure<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/financial\/\" rel=\"category tag\">Financial<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/hacking\/\" rel=\"category tag\">hacking<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ransomware\/\" rel=\"category tag\">ransomware<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/retail\/\" rel=\"category tag\">retail<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a>","tag_info":"Threats","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7811","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=7811"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7811\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=7811"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=7811"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=7811"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":7811,"date":"2025-07-17T16:37:53","date_gmt":"2025-07-17T21:37:53","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=85231"},"modified":"2025-07-17T16:37:53","modified_gmt":"2025-07-17T21:37:53","slug":"united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/07\/17\/united-natural-foods-loses-up-to-400m-in-sales-after-cyberattack\/","title":{"rendered":"United Natural Foods loses up to $400M in sales after cyberattack"},"content":{"rendered":"