United Natural Foods says week-long cyber incident will impact quarterly income

The biggest supplier to Whole Foods said it has restored systems that were brought down by a cyberattack earlier this month. 

But the incident — which has spawned eerie local news images of empty grocery store shelves — is likely to have an effect on the company’s income for the final quarter of its fiscal year, which ends in August.

United Natural Foods (UNFI) provided an update to regulators at the Securities and Exchange Commission on Thursday afternoon, writing that the June 5 cyberattack forced the company to take systems offline that manage fulfillment and distribution of customer orders. 

“Importantly, the Company has safely restored the core systems that its customers and suppliers use for electronic ordering and invoicing, which has enabled business operations to normalize,” the company said in the filing. 

“At this time, the Company does not anticipate sending any notifications to individual consumers as a result of this incident because it did not involve a breach of security of personal information or protected health information, as those terms are defined at law.”

UNFI is now able to regularly receive and ship products to retailers across North America after weeks of delays left certain stores missing key items.

It took about 10 days for most digital systems the company uses to be restored to some extent. Local news outlets reported that grocery stores were using paper and pen to track deliveries. 

The attack has not been claimed by a cybercriminal organization as of Friday. 

Near-term impact

UNFI reported more than $8 billion in net sales last quarter but explained that in the weeks following the attack, it “experienced reduced sales volume and increased operational costs as the company worked to drive solutions-oriented results for its customers.”

It also had direct expenses related to investigating and remediating the incident. Management said it expects the cyberattack to “have a material impact on the Company’s net income/(loss) … for the fourth fiscal quarter of 2025 compared to its internal projections prior to the incident.” 

UNFI said it has cyber insurance that will cover some amount of the costs but that will likely be paid out at some point in the next fiscal year. Despite the short-term impact, the company said it does not believe the cyberattack will impact the “ability to achieve its previously disclosed longer-term strategic and financial objectives.”

UNFI is the main supplier for Whole Foods and is considered the largest health and specialty food distributor in the United States and Canada. It serves over 30,000 customer locations and offers about 250,000 products managed through 55 distribution centers and warehouses.