2025-06-09 UNITED NATURAL FOODS INC Cybersecurity Incident

Page last updated on June 27, 2025

UNITED NATURAL FOODS INC initially disclosed a cybersecurity incident in an SEC 8-K filing on 2025-06-09 08:31:10 EDT.

Company Summary

UNFI is an independent national distributor of natural, organic and specialty foods and related products.

Incident Details

Material: Unknown
Is Breach: FALSE
Records Compromised: Unknown
Data Types Impacted: No Data Types Tracked (yet)

Compromised Date:
Detected Date: 2025-06-05
Disclosure Date: 2025-06-09
Contained Date: 2024-06-26
Recovered Date:

Attack Goal: Unknown

Costs: No Costs Tracked (yet)

Filings

8-K filed on 2025-06-09

UNITED NATURAL FOODS INC filed an 8-K at 2025-06-09 08:31:10 EDT
Accession Number: 0001020859-25-000021

Item 8.01 Other Events.

On June 5, 2025, United Natural Foods, Inc. (the “Company”) became aware of unauthorized activity on certain of its Information Technology (IT) systems. The Company promptly activated its incident response plan and implemented containment measures, including proactively taking certain systems offline, which has temporarily impacted the Company’s ability to fulfill and distribute customer orders. The incident has caused, and is expected to continue to cause, temporary disruptions to the Company’s business operations. The Company is working actively to assess, mitigate, and remediate the incident with the assistance of third-party cybersecurity professionals and has notified law enforcement. Pursuant to its business continuity plans, the Company has implemented workarounds for certain operations in order to continue servicing its customers where possible. The Company is continuing to work to restore its systems to safely bring them back online.

The investigation to assess the impact and scope of the incident remains ongoing and is in its early stages.

8-K filed on 2025-06-26

UNITED NATURAL FOODS INC filed an 8-K at 2025-06-26 16:46:51 EDT
Accession Number: 0001020859-25-000036

Item 1.05 Material Cybersecurity Incidents.

As previously disclosed in a Current Report on Form 8-K filed with the Securities and Exchange Commission (“SEC”) on June 9, 2025 (the “Prior 8-K”), on June 5, 2025, United Natural Foods, Inc. (the “Company”) became aware of unauthorized activity on certain information technology (IT) systems. As disclosed in the Prior 8-K, the Company promptly activated its incident response plan and implemented containment measures, including proactively taking certain systems offline, which temporarily impacted the Company’s ability to fulfill and distribute customer orders. At this time, the Company does not anticipate sending any notifications to individual consumers as a result of this incident because it did not involve a breach of security of personal information or protected health information, as those terms are defined at law.

The unauthorized activity has since been contained and the Company is now regularly receiving and shipping products to retailers across its distribution network. Importantly, the Company has safely restored the core systems that its customers and suppliers use for electronic ordering and invoicing, which has enabled business operations to normalize. Throughout this process, the Company focused on proactively and transparently engaging with its customers and suppliers to support their unique business needs.

The Company has continued to closely monitor the effect of the incident on its business, financial condition, and results of operations. In the weeks following the incident, the Company experienced reduced sales volume and increased operational costs as the Company worked to drive solutions-oriented results for its customers. The Company has also incurred, and expects to continue to incur, direct expenses related to the investigation and remediation of the incident. Based on the information currently available to the Company, management believes that the incident is reasonably likely to have a material impact on the Company’s net income/(loss) and adjusted EBITDA for the fourth fiscal quarter of 2025 compared to its internal projections prior to the incident. The Company holds cybersecurity insurance that it currently expects will be adequate for the incident, and expects that the full claim and settlement process will extend into its 2026 fiscal year.

Item 7.01 Regulation FD Disclosure.

The Company intends to provide an update on its financial outlook for the remainder of fiscal year 2025 in July that is expected to reflect the Company’s strong operating results through the third quarter of fiscal 2025 and performance in the fourth quarter of fiscal 2025, including the anticipated quantitative impact of the incident described above in Item 1.05.

As of the date hereof, the Company does not expect that the incident described above in Item 1.05 will have a material impact on its financial condition or its ability to achieve its previously disclosed longer-term strategic and financial objectives.

The information contained in this Item 7.01 of this Current Report on Form 8-K shall not be deemed “filed” for any purpose, including for the purposes of Section 18 of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), or otherwise subject to the liabilities of that Section, and shall not be deemed incorporated by reference into any filing under the Securities Act of 1933, as amended (the “Securities Act”), or under the Exchange Act, regardless of any general incorporation language in such filing.

Company Information