UNFI Cyberattack Poses Supply Chain Risk to Whole Foods, Other Grocers

United Natural Foods Inc. (UNFI) used its third-quarter earnings call to address a major cybersecurity breach that could impact its supply chain and customers, including Whole Foods.

Bill Wilson, reporting in Supermarket News, writes that UNFI posted solid financial results. Net sales rose 7.5% year-over-year to over $8 billion. Gross profit increased 6.1% to $1.1 billion, with adjusted earnings before interest, taxes, depreciation, and amortization rising to $157 million, the highest margin rate in two years.

However, the breach highlighted operational vulnerabilities at a critical time.

UNFI became aware of the breach on Thursday, June 5, and shut down its network by Friday to contain the incident.

The company has since activated its incident response protocols, enlisted the services of third-party cybersecurity experts, and is working to bring its systems back online.

While the scope of disruption remains unclear, executives confirmed that shipping capabilities have been hindered. CEO Sandy Douglas emphasized that UNFI is prioritizing customer service during recovery efforts and reassessing its cybersecurity framework to prevent future incidents.

Douglas used the call to announce strategic initiatives to streamline operations, optimize capital spending, and improve working capital efficiency, and said the company expects its free cash flow goal for fiscal year 2025 to exceed its initial $100 million target by more than 50%.

Nevertheless, the cyberattack and its implications dominated the discussion.

The breach and subsequent investor reaction underscore the growing operational, reputational, and supply chain risks associated with cybersecurity, even amid strong financial performance. It reinforces the need to allocate cyber risks through both customer and vendor contracts, and a legal strategy that emphasizes close monitoring of regulatory compliance.