JBS Foods Confirms $11 Million Ransom Payment After Ransomware Attack

Meatpacking giant JBS USA, a subsidiary of Brazil-based JBS S.A. and the world's largest processor of beef, pork, and poultry, confirmed today that it paid $11 million in bitcoin to ransomware operators following an attack that briefly halted operations at facilities across North America and Australia.

The attack, attributed by the FBI to the REvil ransomware crew, forced JBS to shut down beef and lamb slaughtering operations at multiple plants in the United States, Canada, and Australia for roughly one full production day. Industry analysts warned of potential wholesale meat-price spikes had the disruption lasted longer.

"This was a very difficult decision to make for our company and for me personally," JBS USA CEO Andre Nogueira said in a statement. "However, we felt this decision had to be made to prevent any potential risk for our customers."

JBS said its backup systems were unaffected and that the company was largely back to full capacity within days. The payment, made after most operations had been restored, was framed as insurance against future leaks of stolen data.

The JBS attack is the second high-profile critical-infrastructure ransomware payment disclosed in as many months, following Colonial Pipeline's $4.4 million payment in May. Lawmakers from both parties have called for banning ransom payments to sanctioned entities and for stronger regulatory baselines for operators of food, water, and energy infrastructure.

CISA noted that JBS, like Colonial Pipeline, gained initial access through a relatively unsophisticated vector: in this case, a publicly exposed RDP endpoint configured with reused credentials.