The FBI put it plainly in 2022: an attack that disrupts processing at a protein or dairy facility “can quickly result in spoiled products and have cascading effects down to the farm level as animals cannot be processed”.2 At some of the farm co-operatives it had seen hit by ransomware, production went on, but with “slower processing due to manual operations”.2
The cases below come from meat, dairy, drinks, fresh produce and chilled logistics. In each, the systems stopped. Some companies kept trading by hand or from stock; some found out what cannot be done by hand. Here is what they said, followed by a checklist built from the official advice.
Meat: lines stopped, work by hand
On Tuesday 1 June 2021, JBS stopped cattle slaughter at 13 of its US meat processing plants after a cyber attack. Andre Nogueira, chief executive of JBS USA, said “the vast majority” of its beef, pork, poultry and prepared foods plants would be operating the next day.1 JBS later said it had paid the equivalent of $11 million to the attackers. “This was a very difficult decision to make for our company and for me personally,” Nogueira said.4
In November 2022, Maple Leaf Foods in Canada suffered a system outage stemming from a cyber attack. The company carried out its business continuity plans and “was able to maintain operations throughout the event”, Food Processing reported.5 Attackers had accessed some data and threatened to release it “unless we pay a ransom, which we will not do”, the company said.6 The incident cost at least C$23 million. “Unfortunately, this incident had a much larger impact on our performance than we originally anticipated,” said its chief executive, Michael McCain.5
Dairy and drinks: stock buys time
In May 2025, Arla found “suspicious activity” at its dairy in Upahl, Germany, which “impacted the local IT network”. “Due to the safety measures initiated as a result of the incident, production was temporarily affected,” the dairy co-operative said, and it warned customers of “possible delivery delays and cancellations”.7 Upahl makes, among other products, skyr.8 Production at Arla’s other sites was not affected.7
In Catalonia, in the early hours of Wednesday 10 November 2021, technicians at Damm’s brewery in El Prat de Llobregat, its main production centre, began to detect errors in the system. The company called the attack “molt greu”, very serious, and production stopped.39 Reuters reported that the plant was entirely paralysed for a few hours before a partial restart.10
Damm kept serving its customers. “We have product and we guarantee service to all our customers,” the brewer said (our translation): it had significant stock, three warehouses and about 500 distributors across Spain. But it added that the situation would have been much more problematic in high summer, because its stock does not usually last beyond three days.3
At about 1.30 am on Wednesday 6 March 2024, a cyber attack hit Duvel Moortgat in Belgium. The brewer shut down its servers, and production came to a standstill at all its Belgian sites and at its site in the United States.11 The next day, its main brewery, in Puurs‑Sint‑Amands, restarted. “We have enough stock to supply everyone with beer,” the company said.12
On 29 September 2025, a cyber attack forced Asahi to halt shipments and production at most of its factories in Japan.13 Staff took orders by telephone, wrote them out by hand and sent shipment instructions by fax, and the company postponed the planned launch of 12 new products.14 On 2 October, production of its main beer, Super Dry, restarted at its six breweries in Japan, working through orders received by hand; a full restart at its other factories, including those that produce food and beverage products, was not expected soon.13
Fresh and chilled: plants, warehouses and lorries
In February 2023, ransomware hit Dole. A memo sent to grocers on 10 February said: “Our plants are shut down for the day and all our shipments are on hold.”15 The attack affected half of the legacy Dole company’s servers and a quarter of its end-user computers, and Dole reported $10.5 million of direct costs.16
In April 2021, ransomware hit Bakker Logistiek, which delivers cheese and other products to Dutch supermarkets. “We could not accept orders and we did not know where in our warehouses particular products were,” said its director, Toon Verhoeven.17 For days, less food reached the supermarkets, and the cheese shelves emptied.18
In May 2025, after a cyber attack, the UK chilled-food firm Peter Green Chilled processed no new orders the next day, while its lorries kept running. Wilfred Emmanuel‑Jones, founder of The Black Farmer and a customer, said “something like ten pallets worth of meat products” risked being thrown away if they could not reach retailers in time.19
What kept them trading, and where it ran out
In their own words, three things kept these companies going:
- People working by hand. Maple Leaf’s chief executive praised “the remarkable work our team did to continue with manual operations during the outage as we meticulously restored our systems”.5 Asahi’s staff took orders by phone and wrote them out by hand.14
- Stock. Damm served its customers from stock, through its warehouses and distributors.3 Duvel had “enough stock to supply everyone with beer”.12
- The parts that kept working. Peter Green Chilled’s transport “continued unaffected”.19 Arla’s other sites kept producing.7
And three things set the limits:
- Time. In high summer, Damm’s stock does not usually last beyond three days.3
- Scale. Bakker Logistiek could not plan deliveries: “we have hundreds of lorries and that cannot be done by hand”.17
- Shelf life. A customer of Peter Green Chilled feared ten pallets of meat would be thrown away.19
The official advice starts from the same place. The FBI tells food and agriculture companies to “identify critical functions and develop an operations plan in the event that systems go offline” and to “think about ways to operate manually if it becomes necessary”.2 CISA and its partners say the ability “to revert to manual controls to quickly restore operations is vital in the immediate aftermath of an incident”.20
A one-page continuity checklist
For a managing director, the official advice fits on one page. Go through it with your production manager, your IT provider and the contractors who maintain your lines and your refrigeration. For what a food plant runs, system by system, see our machines page.