BlastWaveBlastWaveHACKOPEDIA
Hackopedia • Food, Beverage and Retail edition
5 files

Cyberattacks on Food, Beverage and Retail: The Verified Record

Volume 25 entries88 sources citedAll verified since Updated

The Food, Beverage and Retail edition of Hackopedia: five incidents at retailers, food processors, brewers and a sugar miller, from 2013 to 2026. Each entry separates what is verified from what is only reported or unknown.

Summary

Hackopedia's Food, Beverage and Retail edition covers five incidents from 2013 to 2026, from the Target breach to Mackay Sugar. In four, production or trading stopped: JBS's meat plants, Coop Sweden's stores after the Kaseya attack, Asahi's orders and shipping, and, by growers' account, two Mackay Sugar mills. No entry records an intruder reaching a plant or mill control system.

The five incidents in the Food, Beverage and Retail edition

Sorted by file number. The tag says how far the public record goes, not how serious the incident was.

File 006 · 2021JBS Ransomware Attack (2021)United States, Canada and Australia

An intrusion on servers supporting North American and Australian IT led JBS to shut systems down, stopping meat plants in three countries; it paid $11 million after most had reopened.

REvil and Sodinokibi, per the FBIFile 011 · 2013Target Data Breach (2013)US stores

Credentials stolen from a refrigeration and HVAC contractor led to malware on store registers and about 40 million card accounts taken; no primary record read puts the HVAC system in the path.

Attacker undisclosedFile 012 · 2021Kaseya VSA Supply-Chain Ransomware Attack (2021)Global; Coop stores in Sweden

Vulnerable VSA servers pushed REvil ransomware to the computers they managed; Coop Sweden's tills and scales stopped working and it closed most of its roughly 800 stores.

Claimed by REvil; one man pleaded guiltyFile 035 · 2025Asahi Ransomware Attack (2025)Japan

Ransomware hit Asahi's data center network in Japan and, by its account, containment stopped order placement and shipping; all six breweries were producing again on 2 October.

Claimed by QilinFile 038 · 2026Mackay Sugar Cyber Incident (2026)Queensland, Australia

By the growers' account, two of three mills and the harvest feeding them stopped; the company never said ransomware, and all three mills were operational by 26 June.

Claimed by The Gentlemen

Food, beverage and retail cyber incidents by year and record status

YearIncidentWhereRecord status
2021JBSUnited States, Canada and AustraliaREvil and Sodinokibi, per the FBI
2013TargetUS storesAttacker undisclosed
2021Kaseya VSAGlobal; Coop stores in SwedenClaimed by REvil; one man pleaded guilty
2025AsahiJapanClaimed by Qilin
2026Mackay SugarQueensland, AustraliaClaimed by The Gentlemen

What the headlines got wrong about food, beverage and retail cyberattacks

One widely repeated claim from each entry, and what the record says. Each entry lists more, with sources.

Widely repeated claimWhat the record saysEntry
"JBS paid an $11 million ransom to restore operations."JBS says the vast majority of its facilities were operational at the time of payment, and credits the recovery to backup servers that were not affected. By its account, the backups restarted the plants, not the ransom.JBS
"Target was hacked through its air conditioning."A contractor's stolen login, not its HVAC work. The contractor said its link was for billing, contracts and project management, with no remote monitoring or control of heating or cooling. Target and the states say credentials.Target
"The Kaseya attack impacted over 1,500 organizations."Kaseya said "fewer than 1,500 downstream businesses," a ceiling, and its press release said about 800 to 1,500. No count of encrypted businesses exists.Kaseya VSA
"The attack cost Asahi ¥47.5bn."¥47.5bn is the June 2026 cut to the net profit forecast, with several named causes. Asahi's own estimate of profit impact is about ¥17.0bn, and that is not a total cost either.Asahi
"Mackay Sugar was hit by a ransomware attack."The company never said ransomware or encryption in any of its six statements. The word comes from a leak-site claim, reported by the press, that the company acknowledged but did not confirm.Mackay Sugar

BlastWave analysis: business systems, physical stops

Analysis, not a disclosed fact

In four of the five entries, what stopped production or trading was the loss of business systems and the companies' own containment, not an intruder on plant equipment: JBS shut down affected systems, Coop's tills and scales stopped with a supplier's remote management tool, and Asahi's containment stopped orders and shipping. That is BlastWave's reading of the record, not a finding of any investigator. It is why the entries' recommendations focus on what the physical operation needs from business systems, on vendor and remote management access, and on restore copies an attacker cannot reach.

Frequently asked questions

What are the major cyberattacks on food, beverage and retail companies?

The Food, Beverage and Retail edition documents five: the Target data breach (2013), the JBS ransomware attack (2021), the Kaseya VSA attack that closed most of Coop Sweden's stores (2021), the Asahi ransomware attack (2025) and the Mackay Sugar cyber incident (2026). Each entry separates what the companies and governments stated from what was only reported.

Was Target hacked through its HVAC system?

No primary record read puts the HVAC system in the path. In late 2013 an intruder used credentials stolen from one of Target's vendors, a refrigeration and HVAC contractor, to put malware on registers in its US stores, taking data on about 40 million card accounts. The contractor said its connection to Target was for billing, contracts and project management.

Did JBS pay a ransom?

Yes. JBS says it paid the equivalent of $11 million in ransom, and that the vast majority of its facilities were operational at the time of payment; it credits the recovery to backups the attack did not reach. The FBI attributed the May 2021 attack to REvil and Sodinokibi. JBS's total cost is undisclosed; the $11 million is the ransom.

Why did Coop Sweden close its stores in 2021?

On 2 July 2021 attackers used vulnerabilities in on-premises servers running Kaseya's VSA remote management software to push REvil ransomware to the computers those servers managed. Coop never bought the tool, but its tills, self-checkouts and scales were made unusable, and it closed most of its roughly 800 stores. No industrial control system is in the record.

How long were Asahi's breweries stopped?

Asahi said ransomware hit its data center network in Japan in September 2025, and that its containment measures stopped order placement and shipping. All six breweries were producing again on 2 October 2025, and delivery lead times were normal by February 2026. Qilin claimed the attack; Asahi has named no group.

How does Hackopedia verify a food, beverage or retail incident?

Every figure, date and quotation in an entry traces to a court record, a government or regulator document, the company's own dated statements or filings, a named researcher's published work, or a dated publication named as such. Claims resting on press, leak sites or unnamed sources are marked as reported, and errors in Hackopedia's own first volume are corrected on the page.

Other editions

WaterOil and GasManufacturingEnergyTransportation and LogisticsStuxnet

Cite this page

BlastWave. “Cyberattacks on Food, Beverage and Retail: The Verified Record (2013 to 2026).” Hackopedia, Volume 2, Food, Beverage and Retail edition. Last verified 28 September 2026. https://hackopedia.blastwave.com/food-beverage-retail/

Revision history

DateChange
6 Oct 2026Food, Beverage and Retail edition published with five entries. FILE numbers run across all of Hackopedia Volume 2, not by edition.

How Hackopedia verifies an entry

Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry