In May 2021 JBS shut down its own servers after a ransomware attack, and meat plants in three countries stopped. JBS says backups had it fully running within two days. The $11 million ransom was paid after most plants reopened.
JBS stopped its own plants. On 30 May 2021 it found an intrusion on servers supporting its North American and Australian IT systems and shut the affected systems down, in its parent's later word, “voluntarily.” Plants in three countries stopped. JBS says its backup servers were not affected and it was back to full operations within two days. At the time of payment, JBS said, the vast majority of its facilities were operational. By its own account, the ransom did not restart the plants. The backups did.
So the question is why a decision about IT servers stopped kill floors at all. BlastWave's analysis, not a disclosed fact: whatever tells a plant what to run, for whom and onto which truck sat close enough to the intrusion that stopping everything was the safe call. JBS's fallback was a restore path, and it worked. What the record cannot answer is whether anyone could have run without it.
What is not known: Nobody has published how the attacker got in or which systems were encrypted. JBS never said which of those systems its plants needed in order to run, and no statement says whether any plant control system was reached: the record is silent, not clear. The payment date is undisclosed beyond JBS saying most plants were running by then; bitcoin comes from press and Congress, not JBS. JBS reported preliminary findings of no data compromised and published no final one. The parent has never filed a cost or the ransom.
Recommendation
Take IT's reach away from production Whatever decides what a plant runs, labels and ships belongs where a business-side intrusion cannot reach it, so containing IT does not have to stop the floor.
Remove credential-based remote access No remote session into business or plant networks on a password alone; bind access to a verified identity and device. JBS's initial vector is undisclosed.
Read production one way; keep a fallback Scheduling and billing take plant data over a one-way path. Restore copies stay offline and tested, and a paper path for the dock is exercised before it is needed.
Sources: JBS USA statements, 31 May, 1 Jun and 9 Jun 2021; FBI statement, 2 Jun 2021; USDA release 0120.21, 1 Jun 2021; Pilgrim's Pride FY2021 Form 10-K; JBS N.V. Form 20-F, 25 Mar 2026. Full list with links.
Soft Spots: Plant control systems: silence, not clearance. That production-gating systems sat close to the intrusion is BlastWave's analysis. The ransom sequence rests on JBS's own account; the payment date is undisclosed.
The full record
Every claim numbered to its source. Last updated .
JBS shut down its own servers, meat plants in three countries stopped, and by its own account backups had it running again within two days. What is verified, what is only reported, and what is still unknown.
Summary
On 30 May 2021, JBS USA found an intrusion on servers supporting its North American and Australian IT systems and shut the affected systems down, stopping meat plants in three countries. The FBI attributed it to REvil and Sodinokibi. JBS says untouched backups restored full operations within two days, and that it paid $11 million after most plants had reopened.
Timeline of the JBS ransomware attack
Every date is tied to a source. Press reporting appears only as evidence of what was said.
JBS USA determines it is the target of an organized cybersecurity attack affecting some of the servers supporting its North American and Australian IT systems.1,2
JBS USA says it suspended all affected systems, notified authorities and brought in incident response experts, and that its backup servers were not affected.1
The White House says JBS told the administration the ransom demand came from a criminal organization likely based in Russia. USDA asks major meat processors to accommodate additional capacity. JBS and Pilgrim's say the Canada beef facility has resumed production, Mexico and the UK were not impacted, and the vast majority of plants will be operational the next day. Bloomberg reports that JBS's five biggest US beef plants have halted, nearly a fifth of America's production.3,5,8,9
The FBI attributes the attack to REvil and Sodinokibi.4
All JBS USA and Pilgrim's facilities have resumed production, according to the parent's later filings. JBS says all of its global facilities are fully operational.2,10
JBS USA confirms it paid the equivalent of $11 million in ransom and says the vast majority of its facilities were operational at the time of payment. The payment date itself is not disclosed.6
The chair of the House Committee on Oversight and Reform writes to JBS USA's chief executive requesting documents by 24 June 2021.11
Pilgrim's Pride's annual report records a loss of about $10.0 million from the attack in the second quarter of 2021, including $2.4 million allocated from the ransom paid by its parent.7
JBS N.V.'s annual report on Form 20-F describes the shutdown as voluntary and a return to full operations within two days, with backups not affected by the attack.2
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
Where was the intrusion?
"Some of the servers supporting its North American and Australian IT systems"1
Verified
Who shut the systems down?
JBS itself, "voluntarily," in its parent's filings2
Verified
Were plant control systems reached?
No statement says either way. A silence, not a clearance
Undisclosed
Were the backups affected?
"Not affected," per JBS and its parent's filings1,2
Verified
Who was behind it?
REvil and Sodinokibi, per the FBI. No state attribution4,5
Verified (FBI attribution)
How did the attacker get in?
Not published by JBS, the FBI or any responder
Undisclosed
How many US beef plants stopped?
Bloomberg: JBS's five biggest, nearly a fifth of US production9
Reported only
Time to full operations
"Within two days"; all facilities resumed production by 3 June 20212
Verified (company's account)
Ransom paid
"The equivalent of $11 million," after the vast majority of facilities were operational; payment date undisclosed6
Verified (company's account)
Incident cost to JBS
None filed by the parent in the SEC filings searched; EDGAR full-text search finds none of them containing the word "ransom"12
Undisclosed
Pilgrim's Pride loss
About $10.0 million in Q2 2021, including $2.4 million of the ransom7
Verified (subsidiary only)
Was data stolen?
Preliminary results: no company, customer or employee data compromised. No final result published6
Verified (preliminary)
Were JBS's meat plants hacked?
Nothing on the record says the attacker reached a plant's control systems, and nothing says they were clean. JBS described the intrusion as affecting "some of the servers supporting its North American and Australian IT systems."1 No statement from JBS, the FBI, the White House or USDA describes plant control systems at all, in either direction.1,4,5,8 That is a silence, not a clearance.
"The company's backup servers were not affected."
What stopped production, on the record, was the company's own decision to shut down affected IT systems, not any attacker action on plant equipment that the record describes.2 JBS has never said which of its business systems its plants needed in order to run.
Why did JBS's meat plants stop?
Because JBS shut down its own affected systems to contain the intrusion. JBS USA said on 31 May 2021 that it took immediate action, suspending all affected systems, notifying authorities and engaging incident response experts.1 The parent's later SEC filings describe the same step this way:
"voluntarily shutting down all affected systems to isolate the intrusion, limit the potential infection and preserve core systems"
In JBS's own words, operations in North America and Australia were affected, its Canada beef facility resumed production on 1 June, and Pilgrim's operations in Mexico and the UK were not impacted and conducted business as normal.2,3
The count of US beef plants is Bloomberg's, not JBS's. Bloomberg reported on 1 June 2021 that JBS's "five biggest beef plants in the U.S." had halted, "nearly a fifth of America's production." The same report's "about a quarter of U.S. beef capacity" is JBS's share of the market, not the share that stopped.9
How did JBS recover so quickly?
By the company's account, from backup servers the attack did not reach. JBS said on 31 May 2021 that its backup servers were not affected.1 The parent's filings say restoring the systems critical to production was prioritized, that all JBS USA and Pilgrim's facilities had resumed production by 3 June 2021, and that the loss was limited to less than one day of production.2 On 3 June JBS said all of its global facilities were fully operational.10
"the encrypted backup servers, which were not affected by the Cyberattack, allowed for a return to full operations within two days."
"Encrypted" here is JBS describing its own protection, not damage done by the attacker. Read quickly, a protected backup turns into a ransomed one. The same filings say, in the same sentence, that the backups were not affected.2
Did JBS pay the ransom to get its plants back?
No, by JBS's own account: the vast majority of its facilities were running before it paid. On 9 June 2021 JBS USA confirmed it paid "the equivalent of $11 million" in ransom. The next sentence of the same statement reads:6
"At the time of payment, the vast majority of the company's facilities were operational."
The stated reason was "to mitigate any unforeseen issues related to the attack and ensure no data was exfiltrated."6 By the company's account, the ransom did not restart the plants. The backups did. The sequence rests on JBS's own statement, not an independent finding.
The exact payment date is undisclosed. That the payment was made in bitcoin comes from press reporting and the House Oversight chair's letter of 10 June 2021, not from JBS.11 That letter asked JBS USA for documents by 24 June 2021; whether JBS answered, and what it produced, is not public in the records we read.
"Preliminary investigation results confirm that no company, customer or employee data was compromised."
The same statement said third-party forensic investigations were still ongoing. No final result has been published.6
Who was behind the JBS attack?
The FBI attributed it to a criminal ransomware operation, not to a state or a named person.
"We have attributed the JBS attack to REvil and Sodinokibi"
"JBS notified the administration that the ransom demand came from a criminal organization likely based in Russia."
That is a criminal group, described by a federal agency and by the victim. No government attributed the attack to a state. This entry names no individual; whether any Justice Department charging document names JBS was not checked for it. Whether REvil publicly claimed JBS on its leak site was not established in the records we read. The malware name comes from the FBI's attribution; no technical analysis of the JBS intrusion has been published.4
How much did the JBS attack cost?
JBS has never disclosed a cost. The $11 million is the ransom, not the cost of the incident.6 The only filed figure is a subsidiary's. JBS's poultry subsidiary, Pilgrim's Pride, reported:
"a loss of approximately $10.0 million related to the Cyberattack during the second quarter of 2021, which included an allocation of $2.4 million of the total $11.0 million ransom paid by our parent company."
That is one subsidiary's quarter. It is not a JBS total, and nothing supports scaling it up or adding it to the ransom.
The parent has filed no cost and no payment. An SEC EDGAR full-text search of filings from 1 January 2021 to 20 September 2026 returns 28 documents containing "Cyberattack" across JBS S.A. and JBS B.V./JBS N.V., and none containing "ransom." The same search returns seven documents containing "ransom" for Pilgrim's Pride.12 That is a silence in what was searched, not a secret: Brazilian regulatory filings were not read, EDGAR's search may not cover every exhibit, and disclosure rules for a foreign filer differ. We read no motive into it.
What is still not known about JBS
How the attacker got in. No statement by JBS, the FBI or any responder names an initial access vector.
Which systems were encrypted, and which of them JBS's plants needed in order to run.
Whether any plant control system was reached. The record is silent, not clear.
The exact date of the ransom payment, beyond JBS saying most plants were running by then.6
Whether any data was taken. JBS reported preliminary findings of no data compromised and published no final result.6
JBS's total cost. The parent has never filed a cost or the ransom, in the SEC filings searched.12
How many Australian plants stopped and when each restarted.
Whether JBS answered the House Oversight document request of 10 June 2021, and what it produced.11
Claims about JBS the record does not support
Widely repeated claim
What the record says
"JBS paid an $11 million ransom to restore operations."
JBS says the vast majority of its facilities were operational at the time of payment, and credits the recovery to backup servers that were not affected. By its account, the backups restarted the plants, not the ransom.2,6
"Estimated Cost: $11M Ransom"
The $11 million is the ransom. JBS's cost is undisclosed. The only filed loss is Pilgrim's Pride's, about $10.0 million for one quarter, and it is not a JBS total.6,7
"Closure of five meat processing plants across the United States, Canada, and Australia."
The five Bloomberg counted on 1 June 2021 were JBS's five biggest US beef plants alone. JBS's own statements add its Canada beef facility and its Australian operations. No record gives five plants across three countries.3,9
The initial vector was "likely a weak password or phishing campaign."
No initial access vector has been published by JBS, the FBI or any responder. It is undisclosed.1,4
The plant shutdown was involuntary: "OT shutdowns are often an involuntary consequence."
JBS's parent describes "voluntarily shutting down all affected systems to isolate the intrusion."2
Including our own. Our Volume 1 Hackopedia entry on JBS said the company "paid an $11 million ransom to restore operations," listed "$11M Ransom" as the estimated cost, described the "closure of five meat processing plants across the United States, Canada, and Australia," gave the likely way in as "a weak password or phishing campaign," named "Weak Credentials, lack of segmentation" as the prevention failure without a source, and framed the shutdown as "an involuntary consequence" when JBS's parent says "voluntarily." It also presented as fact a plant dependency on "inventory tracking, quality control logging, and logistical scheduling" that JBS never described.13 Every one of those made the story tidier, and most made JBS look worse. All are corrected here. We correct our own record first; it is what earns the right to correct anyone else's.
BlastWave analysis: the backups worked; the question is why the floor stopped
Analysis, not a disclosed fact
JBS sits on this volume's consequence ladder at the rung for IT compromise halting physical operations, and it got there by its own hand. The operator deserves the plain version: by its own account its backups were untouched, it restored the systems critical to production first, and it was back to full operations within two days. That is a fast recovery by any standard.1,2
So the architecture question is not the ransom and not the restore. It is why a decision about IT servers stopped kill floors at all. JBS never said which systems its plants needed in order to run. BlastWave's analysis, not a disclosed fact: whatever tells a plant what to run, for whom and onto which truck sat close enough to the intrusion that stopping everything was the safe call. JBS's fallback was a restore path, and it worked. JBS described no manual way to keep running, though absence of a description is not proof there was none. What the record cannot answer is whether anyone could have run without it.
Podcast: “The Route Sheet” (9:13). Joe Baxter and Cam Cullen on why the backups, not the ransom, brought the plants back, and why a decision about servers stopped the floor.
Video: JBS Short (60 to 90 seconds).
Frequently asked questions
What happened in the JBS ransomware attack?
On Sunday 30 May 2021, JBS USA found an organized cybersecurity attack affecting some of the servers supporting its North American and Australian IT systems. It shut down the affected systems, and meat plants in the United States, Canada and Australia stopped. JBS says its backups were not affected and that it returned to full operations within two days. It later said it paid the equivalent of $11 million in ransom.
Did JBS pay the ransom to get its plants running again?
Not by the company's own account. In its statement of 9 June 2021, JBS USA said it paid the equivalent of $11 million and that at the time of payment the vast majority of its facilities were operational. It said it paid to mitigate unforeseen issues and ensure no data was exfiltrated. Its parent's SEC filings credit the recovery to backup servers that were not affected.
Who was behind the JBS cyberattack?
The FBI said on 2 June 2021 that it had attributed the JBS attack to REvil and Sodinokibi, a criminal ransomware operation. On 1 June 2021 the White House said JBS had told the administration the ransom demand came from a criminal organization likely based in Russia. No government attributed the attack to a state, and this entry names no individual.
How much did the JBS cyberattack cost?
JBS has never disclosed a cost. The $11 million it confirmed on 9 June 2021 is the ransom, not the cost of the incident. Its subsidiary Pilgrim's Pride reported in its 2021 annual report a loss of about $10.0 million for the second quarter of 2021, including $2.4 million allocated from the ransom. That is one subsidiary's figure, not a JBS total.
Were JBS's plant control systems hacked?
The record does not say either way. JBS described the attack as affecting servers supporting its North American and Australian IT systems. No statement from JBS, the FBI, the White House or USDA describes plant control systems at all. The plants stopped because JBS shut down its own affected systems, which its parent's filings call a voluntary shutdown, not because of attacker action on plant equipment that the record describes.
How did the hackers get into JBS?
Nobody has published how. JBS, the FBI and the other federal bodies that commented in 2021 did not name an initial access vector, and no technical analysis of the JBS intrusion has been published. Claims that it began with phishing or a weak password, including in our own earlier Hackopedia entry, were guesses rather than findings.
Was any data stolen in the JBS attack?
JBS USA said on 9 June 2021 that preliminary investigation results confirmed no company, customer or employee data was compromised, while third-party forensic investigations were still ongoing. No final result has been published. JBS also said part of its reason for paying the ransom was to ensure no data was exfiltrated.
Which JBS plants were shut down in 2021?
JBS said its operations in North America and Australia were affected and that its Canada beef facility resumed production on 1 June 2021; its Mexico and UK operations were not impacted. The count of US plants is Bloomberg's: on 1 June 2021 it reported that JBS's five biggest US beef plants had halted, nearly a fifth of US beef production. Its parent says all JBS USA and Pilgrim's facilities had resumed production by 3 June.
Primary sources are JBS's own dated statements, the SEC filings of its parent and its poultry subsidiary, and federal and congressional documents. Press is cited only as evidence of what was said.
CompanyJBS USA, "JBS USA Cyberattack Media Statement - May 31," 31 May 2021. jbsfoodsgroup.com
Company filingJBS N.V., Form 20-F for fiscal year 2025, filed 25 March 2026, Risk Factors (the voluntary shutdown, backups not affected, full operations within two days, less than one day of production, all facilities resumed by 3 June 2021); the same passage appears in JBS S.A.'s Form 20-F filed in 2025 and in the JBS N.V. Annual Report for 2025, filed as Exhibit 99.1 to Form 6-K, 15 April 2026. sec.gov · JBS S.A. Form 20-F (2025)
Company filingJBS USA and Pilgrim's, "JBS USA and Pilgrim's Announce Progress in Resolving Cyberattack," Greeley, Colo., 1 June 2021; filed as Exhibit 99.1 to Pilgrim's Pride Corporation Form 8-K (accession 0000802481-21-000057). sec.gov
FederalFederal Bureau of Investigation, "FBI Statement on JBS Cyberattack," 2 June 2021. fbi.gov
FederalThe White House, "Press Gaggle by Principal Deputy Press Secretary Karine Jean-Pierre Aboard Air Force One En Route Tulsa, OK," 1 June 2021. archives
CompanyJBS USA, "JBS USA Cyberattack Media Statement - June 9," 9 June 2021. jbsfoodsgroup.com
Company filingPilgrim's Pride Corporation, Form 10-K for the fiscal year ended 26 December 2021, filed 18 February 2022, Risk Factors. sec.gov
FederalUS Department of Agriculture, "Statement from the U.S. Department of Agriculture on JBS USA Ransomware Attack," release 0120.21, 1 June 2021. usda.gov
PressBloomberg (Fabiana Batista, Michael Hirtzer and Elizabeth Elkin), published by Al Jazeera, "Slaughterhouse closures spread after cyberattack on meat producer," 1 June 2021. Cited as evidence of what was said. aljazeera.com
CompanyJBS USA and Pilgrim's, "JBS USA and Pilgrim's Announce Resolution of Cyberattack," 3 June 2021. jbsfoodsgroup.com
GovernmentUS House Committee on Oversight and Reform, Chairwoman Carolyn B. Maloney, letter to Andre Nogueira, Chief Executive Officer, JBS Foods USA, 10 June 2021; committee press release, 11 June 2021. PDF · Press release, 11 June 2021
RegulatorSEC EDGAR full-text search, filings dated 1 January 2021 to 20 September 2026: "Cyberattack" and "ransom" for JBS S.A. (CIK 1450123) and JBS B.V./JBS N.V. (CIK 1791942); "ransom" for Pilgrim's Pride Corporation (CIK 802481). Run 24 September 2026 and re-run by hand 28 September 2026.
CompanyBlastWave, Hackopedia Volume 1 entry "JBS S.A. Ransomware Attack (2021)," read 24 September 2026. Cited as evidence of what we said. hackopedia.blastwave.com
Cite this page
BlastWave. “JBS Ransomware Attack (2021): What Is Verified.” Hackopedia, Volume 2, FILE 006. Last verified 28 September 2026. https://hackopedia.blastwave.com/food-beverage-retail/jbs-2021/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 006 in Hackopedia Volume 2, in the Food, Beverage and Retail edition.
28 Sep 2026
Hand-check against the primary record: the SEC EDGAR full-text searches were re-run by hand to confirm the filings counts (28 JBS documents mention the cyberattack, none the ransom, against seven for Pilgrim's Pride), and the entry was checked for consistency with the Colonial Pipeline, Mackay Sugar and Kaseya entries.
26 Sep 2026
Full validation. JBS's statements of 31 May, 1 June, 3 June and 9 June 2021, the FBI statement, the White House remarks, the USDA release, the House Oversight letter and the parent and subsidiary SEC filings were read at source. US plant figures are limited to what Bloomberg reported on 1 June 2021, and Bloomberg's "about a quarter" is identified as JBS's share of capacity rather than what stopped.
24 Sep 2026
Volume 2 entry built from primary sources. Corrected Volume 1 errors: the ransom shown as the cost and as the reason operations were restored, five plants placed across three countries, an initial vector given without a source, and the shutdown described as involuntary.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
