8-K: United Natural Foods Discloses Cybersecurity Incident, Disrupting Customer Orders

United Natural Foods, Inc. (UNFI) announced a cybersecurity incident on June 5, 2025, which has temporarily impacted its ability to fulfill and distribute customer orders and is expected to cause ongoing business disruptions.

Summary

• United Natural Foods, Inc. (UNFI) became aware of unauthorized activity on certain of its Information Technology (IT) systems on June 5, 2025.
• The company promptly activated its incident response plan and implemented containment measures, including proactively taking certain systems offline.
• This incident has temporarily impacted UNFI's ability to fulfill and distribute customer orders.
• The incident has caused, and is expected to continue to cause, temporary disruptions to the company's business operations.
• UNFI is actively working to assess, mitigate, and remediate the incident with the assistance of third-party cybersecurity professionals and has notified law enforcement.
• Pursuant to its business continuity plans, the company has implemented workarounds for certain operations to continue servicing customers where possible.
• The company is continuing efforts to restore its systems to safely bring them back online.
• The investigation to assess the full impact and scope of the incident remains ongoing and is in its early stages.

Sentiment

Score: 3

Explanation: The document reports a significant cybersecurity incident leading to operational disruptions and potential financial, legal, regulatory, and reputational risks. While the company is taking appropriate response measures, the full impact is still unknown, leading to a negative sentiment.

Positives

• The company promptly activated its incident response plan upon becoming aware of the unauthorized activity.
• Containment measures were implemented, including proactively taking certain systems offline to limit the spread of the incident.
• UNFI is actively working to assess, mitigate, and remediate the incident with the assistance of third-party cybersecurity professionals.
• Law enforcement has been notified regarding the incident.
• Business continuity plans have been activated, and workarounds are in place to continue servicing customers where possible.

Negatives

• Unauthorized activity was detected on certain of the company's Information Technology (IT) systems.
• The incident has temporarily impacted the company's ability to fulfill and distribute customer orders.
• The incident has caused, and is expected to continue to cause, temporary disruptions to the company's business operations.
• Certain systems were proactively taken offline, indicating a significant impact on IT infrastructure.
• The investigation into the impact and scope of the incident is still ongoing and in its early stages, implying uncertainty regarding the full extent of the damage.

Risks

• Risks associated with the ongoing assessment and investigation of the incident.
• Risks related to the adequacy of the company's response and the effectiveness of its business continuity plans.
• Risks concerning the magnitude of the potential disruption to the company's business and operations.
• Potential legal risks resulting from the incident.
• Potential regulatory risks resulting from the incident.
• Potential reputational risks resulting from the incident.
• Potential financial risks resulting from the incident.
• Other factors described in the company's filings under the Securities Exchange Act of 1934, including the Risk Factors section in the Annual Report on Form 10-K for the year ended August 3, 2024.

Future Outlook

The company expects the cybersecurity incident to continue causing temporary disruptions to its business operations. The investigation into the impact and scope of the incident is ongoing and in its early stages, with efforts focused on restoring systems to full functionality.

Management Comments

• "The Company promptly activated its incident response plan and implemented containment measures, including proactively taking certain systems offline, which has temporarily impacted the Company’s ability to fulfill and distribute customer orders."
• "The incident has caused, and is expected to continue to cause, temporary disruptions to the Company’s business operations."
• "The Company is working actively to assess, mitigate, and remediate the incident with the assistance of third-party cybersecurity professionals and has notified law enforcement."
• "Pursuant to its business continuity plans, the Company has implemented workarounds for certain operations in order to continue servicing its customers where possible."
• "The Company is continuing to work to restore its systems to safely bring them back online."
• "The investigation to assess the impact and scope of the incident remains ongoing and is in its early stages."

Industry Context

Cybersecurity incidents, including unauthorized system activity and operational disruptions, represent a significant and escalating threat across all industries, particularly for companies heavily reliant on complex IT infrastructure for supply chain management and distribution, such as those in the wholesale food sector. UNFI's disclosure highlights the pervasive nature of these risks and underscores the critical importance of robust cybersecurity defenses, incident response plans, and business continuity strategies to mitigate operational and financial fallout in a highly interconnected global economy.

Comparison to Industry Standards

• UNFI's prompt activation of an incident response plan and engagement of third-party cybersecurity professionals aligns with industry best practices for initial containment and investigation of significant cyber incidents.
• The proactive measure of taking certain systems offline is a common and often necessary step in the early stages of a major cyberattack to prevent further compromise, mirroring actions taken by other large enterprises facing similar threats.
• The implementation of business continuity plans and workarounds to maintain customer service, where possible, demonstrates an effort to minimize operational impact, which is a key aspect of resilience in supply chain-dependent industries.
• Notifying law enforcement is standard procedure for significant cybersecurity events, indicating compliance with legal obligations and cooperation with authorities.
• The acknowledgment of potential legal, regulatory, reputational, and financial risks is consistent with the typical disclosure requirements and challenges faced by publicly traded companies following a major cybersecurity incident.

Legal Proceedings

• The company has notified law enforcement regarding the unauthorized activity on its IT systems.
• The incident carries potential legal risks for the company.

Stakeholder Impact

• Customers: Expected temporary disruptions to order fulfillment and distribution.
• Shareholders: Potential exposure to financial, reputational, and operational risks that could negatively impact share price and company value.
• Employees: Potential impact on daily workflow and operations due to systems being offline and the implementation of workarounds.
• Suppliers: Possible disruptions in the supply chain if UNFI's ability to receive or process goods is affected by the IT issues.

Next Steps

• Assess, mitigate, and remediate the cybersecurity incident.
• Restore affected IT systems to safely bring them back online.
• Continue the ongoing investigation to fully assess the impact and scope of the incident.

Key Dates

Recommendation

Keywords

United Natural Foods, UNFI, cybersecurity incident, IT systems, business disruption, customer orders, supply chain, wholesale food distribution, data security, cyberattack, SEC filing, 8-K