United Natural Foods cyberattack

Analyst assessment

United Natural Foods experienced a cyberattack in June 2025 that disrupted grocery ordering, fulfillment and distribution. The Providence, Rhode Island-based wholesaler said it detected unauthorized activity June 5 and took systems offline as part of its response. Its June 9 filing acknowledged that customer orders and deliveries were affected. Our initial reporting documented the resulting food supply disruption.

The incident’s operational effects extended beyond UNFI’s own systems. Bloomberg News reported empty shelves at a Whole Foods Market store in Manhattan and quoted the retailer’s spokesperson describing efforts to restock. Natural Grocers later confirmed in its annual filing that the UNFI incident caused product shortages at its stores during June and July. Those findings establish downstream supply effects; they do not establish intrusions into the retailers’ own networks.

Operational significance

UNFI’s systems support the movement of groceries from suppliers to retailers. Shutting them down impaired the electronic processes used to receive orders, select products, arrange shipments and invoice customers. Bloomberg’s reporting distinguished detection June 5 from a complete protective network shutdown by the evening of June 6. It also described employees preparing shipments with pen and paper, citing a warehouse worker.

The company’s dated recovery updates show a gradual return of capacity. Ordering and receiving capabilities began returning June 11, and the company reported shipping and receiving at most distribution centers by June 13. Manual and alternative processes continued while technology was restored. The June 26 update said core electronic ordering and invoicing systems were back online and deliveries were approaching normal levels.

Core system restoration did not end every operational problem. On its July 16 business update call, management described normalized commercial capacity, with distribution center performance at or near earlier levels. It also said some reporting and other supporting tools remained under restoration and that delayed purchase orders, invoices and payments required follow-up work. Natural Grocers’ subsequent account of shortages into July further limits treating June 26 as the end of all downstream disruption.

The incident also had a financial aftermath. UNFI’s July 2025 outlook estimated a $350 million to $400 million effect on fiscal 2025 sales. Its fiscal 2026 annual filing later reported $26 million in incident-related costs and charges during fiscal 2025, an additional $24 million during fiscal 2026 and $50 million in insurance proceeds received during fiscal 2026. The costs, sales estimate and insurance proceeds measure different effects and should not be added together as a single loss figure.

Confidence and uncertainty

Confidence is high in the cyberattack and distribution disruption because UNFI documented both in company statements and regulatory filings, while a retailer separately confirmed shortages. UNFI’s June 26 filing said the incident did not involve a breach of personal information or protected health information as those terms are defined by law. That finding addresses specified information categories; it does not establish that all business information was unaffected.

The reviewed company disclosures do not identify an attacker or substantiate ransomware, encryption, data theft, a ransom demand or payment. Early descriptions of ransomware-like features are insufficient to establish the mechanism. Similar attacks against other retailers do not identify the perpetrators in this case.

Analytic gaps

The initial access method, intrusion onset before detection and full technical scope remain unverified. The exact date when every supporting capability and downstream supply problem ended is also unknown. Later retailer disclosures confirm that operations normalized, supporting a resolved assessment, while June 26 remains a core systems milestone. Subsequent costs and insurance recovery do not establish that an operational outage continued into fiscal 2026.