Ongoing cyberattack at US grocery distributor giant UNFI affecting customer orders

United Natural Foods (UNFI) is working to restore its systems after a cyberattack disrupted its grocery distribution network, impacting its ability to fulfill customer orders. The company, a primary distributor for Whole Foods, shut down its entire network after identifying unauthorized access, leading to limited shipments and potential empty shelves at affected stores; the full extent of the disruption remains unclear. UNFI reported $8.1 billion in net sales for the quarter but is not adjusting its financial outlook due to the cyberattack's ongoing assessment, despite previously expecting a loss due to the ending of a contract.

Analysis

United Natural Foods (UNFI) is currently navigating a significant operational disruption following a cyberattack last week, which has necessitated a complete shutdown of its IT network and impaired its ability to fulfill and distribute customer orders, including for key client Whole Foods, owned by Amazon. The company, which reported $8.1 billion in net sales for the quarter ended May 3, 2025, confirmed it is shipping to customers on a limited basis, leading to anecdotal reports of diminished store shelves, though the full extent of the supply chain impact is yet to be determined. While UNFI is actively working to restore systems and assist customers, external-facing systems remain offline, and the nature and full financial ramifications of the attack are under ongoing assessment. Notably, UNFI has stated it is not adjusting its 2025 financial outlook at this time, despite the cyber incident and a pre-existing expectation of a net income and earnings per share loss for 2025 due to a terminated contract with a U.S. northeast grocery chain. The situation presents considerable uncertainty regarding the timeline for full operational recovery and the ultimate costs associated with the breach and subsequent business interruption.

Key Decisions for Investors

• Investors in UNFI should closely monitor the company's progress in restoring full operational capacity, the forthcoming details on the financial impact of the cyberattack, and any subsequent revisions to its 2025 outlook, which was already under pressure.
• A cautious approach towards UNFI is advisable given the severe operational disruption, the unquantified costs related to the cyberattack, and the potential for reputational damage and customer churn if service restoration is prolonged.
• Consider the heightened risk profile for UNFI due to cybersecurity vulnerabilities and the potential for increased capital expenditure on IT security, which could impact future profitability beyond the immediate effects of this incident.