JBS says it paid an $11M ransom in bitcoin to resolve an attack last week; the payment was made after most plants were operational to avoid further disruption
Meat supplier's U.S. chief says firm paid cybercriminals in bitcoin to avoid more disruptions — JBS USA Holdings Inc. paid …
Context & Ripple Effects
JBS had already paused Australian operations and slaughter at plants in many U.S. states during the initial ransomware disruption. By the following day, it said the vast majority of plants would be operating again; the newly disclosed payment therefore separates restoring operations from eliminating the risk of further disruption.
The FBI had attributed the attack to the REvil ransomware group. JBS's decision to pay in bitcoin after restarting plants adds another high-profile case in which a critical supplier treated a ransom as part of incident resolution.
First-order effects
- JBS absorbs an $11 million bitcoin payment after its plants largely resumed operations, aiming to limit additional disruption rather than relying solely on the operational restart.
- REvil receives a payment tied to an attack that interrupted JBS's meat-processing operations, reinforcing the immediate financial payoff of targeting a large operator.
Second-order effects
- Other operators of essential supply chains will weigh JBS's post-restart payment alongside Colonial's payment that did not replace the need for backups, making recovery capability and ransom decisions parallel parts of incident response.
- Ransomware groups gain another public signal that disruption of physical operations can produce large bitcoin payments, increasing pressure on targeted companies to restore services quickly while assessing extortion demands.
Third-order effects
- Across JBS, Colonial and Brenntag, ransomware is becoming an operational-continuity problem for industrial companies, not only a data-security incident; backup and recovery plans become more consequential in negotiations.
- If this pattern persists, attacks on concentrated physical supply chains will keep linking cyber resilience to decisions over crypto payments, intensifying scrutiny of how firms manage both disruption and extortion.
The trend: Ransomware attacks are increasingly targeting companies whose physical operations create immediate leverage, forcing recovery planning and payment decisions into the same crisis playbook.