What a cyber attack costs a food company: the figures from their own accounts

Ask a managing director what a cyber attack costs and the first answer is often the ransom. Companies that have been through one tell a different story in their accounts. The big numbers are sales they could not make, products they could not ship and the weeks it took to get back to normal. This article sets out what companies across the food chain reported, each figure in its own currency and with what it measures.

Why their own accounts, not the headlines

Early estimates move. In May 2025, Marks & Spencer (M&S), the British food and clothing retailer, estimated that its attack would cost about £300 million of operating profit in its year to March 2026, and said it hoped to halve that through insurance, cost control and other actions.² Six months later its half-year results gave firmer figures: £324 million of lost sales, £100 million recovered through insurance, and an expected hit to profit of around £136 million for the year.¹

So this article uses what the companies themselves reported: results, trading updates, annual reports and filings with the US Securities and Exchange Commission, read in the document or in the press report that quotes it. Three rules hold throughout. Each figure stays in its original currency. Each says what it measures, because lost sales, lost profit, extra costs and a ransom are different things. And no figure is added to another, because they come from different companies, years and accounts.

The figures

What the numbers have in common

Only one line in the table is a ransom. JBS said it paid the equivalent of $11 million. “This was a very difficult decision to make for our company and for me personally,” said Andre Nogueira, chief executive of JBS USA.¹⁷ Maple Leaf said attackers were threatening to release data “unless we pay a ransom, which we will not do”.¹⁶

Everything else in the table comes from the business stopping, and the companies described it in similar terms:

• M&S switched off its automated stock systems and used pen and paper to move fresh food, drinks and clothing.² It stopped taking online clothing orders for 46 days.³
• Co-op took systems offline. Availability in its stores fell, shelves emptied, and the data of all 6.5 million members was stolen.⁶
• Americold, which runs temperature-controlled warehouses, “took operations offline” in April 2023,¹¹ and customers were asked to cancel or reschedule deliveries, except critical perishable products.¹²
• At Dole, a memo to grocers read: “Our plants are shut down for the day and all our shipments are on hold.”¹³
• Mondelez said the malware “affected a significant portion of our global sales, distribution and financial networks”, and that shipments delayed at the end of the quarter were only partly recovered.⁸ It told a court it had lost more than 1,700 servers and 24,000 laptops.⁹
• Maple Leaf kept operating through the outage with manual operations, but “normal business activities were interrupted”, and its chief executive wrote that “this incident had a much larger impact on our performance than we originally anticipated”.¹⁵

Working by hand keeps a business open. It does not keep it at full speed.

Insurance helps, but not always

Insurance appears in several of these accounts, in different ways:

• M&S recovered £100 million through an insurance payout.¹
• UNFI’s estimates leave out “the benefit of anticipated insurance proceeds”, which it expected to be adequate for the incident.⁷
• Americold’s figure is already net of insurance recoveries.¹⁰
• Mondelez made a claim of about $100 million on its property insurer, Zurich, which argued that the damage fell under a war exclusion. The two settled in 2022 on terms that were not disclosed.⁹
• Dole’s chief executive warned that the company did not expect to recover the costs in full, noting that getting sufficient insurance in North America was “prohibitive”.¹⁴
• After the October 2026 attack on French supermarket refrigeration, Intermarché’s chief executive estimated losses of “tens of millions of euros nationwide in a single day”, an estimate rather than an audited figure.¹⁸ The group warned that insurance would be one of the sticking points, as policies may not “cover this type” of incident.¹⁹²⁰

One market rule is worth knowing. For policies starting on or after 1 January 2020, Lloyd’s has required first-party property damage policies to “affirm or exclude cyber cover”.²¹ The rule binds Lloyd’s syndicates, not every insurer, but its question applies to any policy: does yours cover spoiled stock and stopped production after a cyber attack, or exclude them? Ask your broker before you need the answer.

Work out your own exposure

The companies above are large. Yours is probably smaller, and only you have its numbers. A rough estimate needs six of them:

1. Your gross margin on an ordinary day.
2. The days you could not take orders, produce or ship. In the cases above, that ran from a day at Dole’s plants to 46 days without online clothing orders at M&S.³¹³
3. The stock that would spoil in that time, in cold rooms, on the line and on the road.
4. The extra cost of working by hand, overtime and catching up.
5. The penalties in your supply contracts. In Spain, food supply contracts must be in writing and must set out, at a minimum, the penalties for non-conformities and incidents, and the exceptions for force majeure.²²
6. What your policy would pay, and what it excludes.

Multiply the first figure by the second, add the next three, and take away the sixth. Then ask how many days your business could carry that.

Where Cantic fits