A ransomware attack has disrupted services at JBS SA, a major meat producer, according to the White House.
JBS previously described the disruption as an organized cyberattack. But on Tuesday, the Biden administration disclosed that the company told US officials the assault originated from a ransomware strain. “JBS notified the administration that the ransom demand came from a criminal organization likely based in Russia,” White House deputy press secretary Karine Jean-Pierre said on Tuesday.
It remains unclear which ransomware group hit JBS. But according to Bloomberg, the disruption has halted processing at five plants in the US, and wiped out a fifth of US beef production.
The incident echoes last month’s ransomware attack on Colonial Pipeline, which temporarily shut down the company’s oil pipelines in the southeastern US. Federal investigators suspected the attack came from a cybercriminal group based in Russia known as DarkSide. However, DarkSide appears to have since disbanded.
Ransomware often arrives through phishing emails or vulnerabilities in a company’s IT systems. The goal is to infect as many computers as possible. The ransomware will then encrypt the data inside the machines, and demand the victims pay up in Bitcoin or risking losing their files.
JBS, which is based in Brazil, didn’t immediately respond to a request for comment. But the company previously said the attack hit some servers in North America and Australia. “The company’s backup servers were not affected, and it is actively working with an Incident Response firm to restore its systems as soon as possible,” it added.
In response, the Biden administration said the FBI is investigating the incident. US officials are also working to assess the impact of the attack on the supply chain, and what can be done to mitigate the fallout.
In addition, “the White House is engaging directly with the Russian government on this matter and delivering the message that responsible states do not harbor ransomware criminals,” the deputy press secretary said.