Loading story…
JBS, the world’s largest meat processor, paid an $11 million ransom after a cyberattack attributed by the FBI to the REvil ransomware group disrupted operations across North America and Australia. The attack temporarily disabled all of the company’s meat processing plants in the United States, led to plant shutdowns and canceled shifts, and raised concerns about meat supply and prices because of JBS’s central role in the food supply chain. The White House said the company had reported a ransom demand from a criminal organization likely based in Russia, while the FBI investigated and CISA provided technical support as JBS worked to restore systems.
JBS said it decided to pay after most affected facilities were back online in order to reduce the risk that stolen or encrypted data could be destroyed and to limit further disruption to customers and suppliers. The payment drew immediate political scrutiny in Washington: House Oversight and Reform Committee Chair Carolyn Maloney demanded records and an explanation from CEO Andre Nogueira, arguing that ransom payments can encourage more attacks and that Congress needs details from major incidents like JBS and Colonial Pipeline to shape ransomware and cybersecurity legislation.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
House Oversight and Reform Committee Chair Carolyn Maloney sent a letter to JBS USA CEO Andre Nogueira seeking documents and explanations about the company's ransom payment and communications with the attackers. She argued that such payments set a dangerous precedent and that Congress needed details to inform ransomware legislation.
JBS paid an $11 million ransom to the attackers after the incident, saying it did so to prevent critical data from being destroyed and to reduce disruption to its operations. The payment later drew political and public scrutiny because of JBS's role in the food supply chain.
As the disruption became public, the White House said JBS had reported a ransom demand from a criminal organization likely based in Russia. The FBI later attributed the ransomware attack to REvil and CISA provided technical support during the response.
JBS reported significant progress restoring affected systems and said the vast majority of its plants were expected to be operational by the following Wednesday. The company also said its backup servers were not affected.
JBS SA disclosed a cyberattack that disrupted production in North America and Australia, causing plant shutdowns and canceled shifts. The incident temporarily disabled all of the company's meat processing plants and raised concerns about food supply impacts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
thehill.com
Open sourceabc.net.au
Open sourcezdnet.com
Open sourcetheverge.com
Open sourcemarketwatch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dairy Farmers of America, a major Kansas-based farmer-owned dairy cooperative, suffered a significant ransomware attack in June, which was later claimed by the Play ransomware group. The attack resulted in unauthorized access to the cooperative's systems, leading to the theft of sensitive personal information belonging to 4,546 individuals. The compromised data included names, dates of birth, Social Security numbers, bank account details, driver's license or state-issued ID numbers, and Medicare or Medicaid numbers. The breach affected both employees and members of the cooperative, which is responsible for marketing and selling milk and related products from its 9,500 farmer-owners and employs approximately 19,000 people. The organization reported $24.5 billion in revenue in 2022 and is responsible for producing about 23% of all U.S. milk, highlighting the potential impact of the attack on the broader food and agriculture sector. The attackers gained access to the network through a sophisticated social engineering campaign, which enabled them to bypass security controls and begin exfiltrating data shortly after the initial compromise. Dairy Farmers of America discovered the breach two days after the attack began and subsequently launched an internal investigation, which concluded on September 15. The organization filed breach notifications with regulators in Maine and began notifying affected individuals, offering two years of identity protection services to those impacted. The Play ransomware group, which has been active since 2022, has been linked to over 900 attacks globally, including dozens of high-profile incidents targeting various sectors. The incident at Dairy Farmers of America is part of a broader trend, with the food and agriculture sector experiencing 84 ransomware attacks in the first quarter of 2025 alone, more than double the number from the same period the previous year. Despite the growing threat, recent bipartisan Senate legislation aimed at improving cyber defenses for the food and agriculture industry has not been enacted. The breach underscores the increasing use of advanced social engineering tactics by ransomware groups to target critical infrastructure and highlights the ongoing vulnerability of the food supply chain to cyber threats. Dairy Farmers of America did not respond to media requests for further comment regarding the incident. The attack has raised concerns about the resilience of essential services and the need for enhanced cybersecurity measures across the agricultural sector. Regulatory scrutiny is expected to increase as a result of the breach, with potential implications for industry-wide security standards. The incident serves as a stark reminder of the risks posed by ransomware to organizations managing sensitive personal and financial data.
Jun 29, 2026
REvil, also known as **Sodinokibi**, abruptly lost its public-facing and backend infrastructure, with its Tor leak and payment sites, clear-web presence, and the `decoder[.]re` domain all going offline at roughly the same time. The disappearance was highly unusual for a group whose infrastructure had been comparatively stable, and it followed REvil’s involvement in several high-profile ransomware incidents, including attacks on **Kaseya** and **JBS Foods**. The outage came amid intense law-enforcement and geopolitical pressure after the Kaseya VSA supply-chain attack, which reportedly impacted about 60 managed service providers and more than 1,500 businesses. Reporting cited several possible explanations, including a government takedown, a legal demand that prompted operators to wipe servers, a voluntary shutdown, technical failure, or a rebranding effort, but no definitive cause was confirmed; researchers also warned that even a successful disruption would not necessarily end the threat, as affiliates could regroup or reappear under a new name.
Aug 15, 2026
Kaseya disclosed a security incident in its **on-premises VSA** remote management platform after attackers exploited a zero-day vulnerability and pushed ransomware through managed service providers to downstream customers. The company ordered on-premises customers to immediately shut down VSA servers, precautionarily took its SaaS infrastructure offline, and said early impact appeared limited to fewer than 40 direct customers, while later estimates put the downstream toll at **800 to 1,500 businesses**. Kaseya said **SaaS customers were not found compromised**, identified VSA as the only affected product, and worked with FireEye Mandiant, the **FBI**, **CISA**, and Emsisoft on containment, forensics, detection tools, hardening guidance, and patches before restoring services. Researchers and media reports linked the campaign to the **REvil** ransomware gang, which used infrastructure associated with prior REvil operations and demanded **$70 million in bitcoin** for a universal decryptor. The attack caused international disruption, most visibly forcing Sweden’s **Coop** grocery chain to close about **800 stores** after payment systems failed, while other Swedish organizations also reported outages. Kaseya later said fewer than 60 direct customers were affected and that it obtained a universal decryptor from a third party on July 21, distributing it with Emsisoft’s help; the company publicly stated it **did not pay a ransom** directly or indirectly to obtain the tool.
Aug 15, 2026