UNFI Sustains Up To $75M Loss From Cybersecurity Incident

United Natural Food Inc. (UNFI)’s ordering systems and distribution centers have nearly returned to normal operating levels, but the company believes last month’s cybersecurity breach will result in a loss between $65 million to $75 million across revenue, adjusted EBITDA and operating costs, said CEO Sandy Douglas in an off-cycle business update call with analysts this morning.

Douglas also provided a revised fiscal 2025 update with a “modest increase” (+0.6%) in net sales and lower midpoint expectations for adjusted EBITDA and adjusted EPS while emphasizing that the company does not expect the cyberattack to have a material impact on its results beyond the fourth quarter.

“Our underlying momentum will continue as we enter fiscal 2026 with our updated outlook,” Douglas said during a call with analysts. “We remain on track to achieve our multi year financial targets at an accelerated pace compared to the initial targets we communicated in October 2024”

According to UNFI, the incident will impact net sales by an estimated $350 to $400 million, with a net loss of between $50 to $60 million (excluding estimated tax impact); adjusted EBITDA will take a hit of between $40 to $50 million. The company expects its cyber insurance policy reimbursement to arrive in early 2026 and believes that sum will sufficiently cover recovery costs of the event.

The company spent approximately $5 million in direct costs on cybersecurity, legal and governance experts, and faces $20 million in “unusually higher [operating] costs” due to the manual workarounds it implemented while servers were offline in addition to higher spoilage and procurement rates, said CFO Giorgio Matteo Tarditi.

“Because of the unique role UNFI plays in the food supply chain, we recognize that this cyber incident impacted our customers and the industry we serve,” added Douglas. “We never want to be the reason that a local grocer is out of stock on a product that their shoppers count on. That’s why our core focus from the moment we took our systems offline was on finding ways to get our customers the products they need.”

Within 10 days after the attack was detected, UNFI said its primary electronic ordering systems were restored and capabilities for inbound product deliveries as well as key back of office systems came back online in the week that followed. By June 26, core systems were back up and running and the company returned to normal operating capacity, Douglas said.

“As of this week, our commercial operating capacity has been restored to normalized levels, average outbound fill rates on time deliveries and units shipped are at or close to pre-incident levels with some variation across DCS, we expect continued improvement as we complete our recovery in the coming weeks,” Douglas explained.

Aside from delaying one new customer onboarding to ensure all systems were back “up to speed” at the start of service, UNFI said it continues to have “productive” business development conversations and believes it has emerged “stronger” from the experience, Douglas emphasized. He noted the distributor continues to prioritize investments in cybersecurity to create an “even stronger perimeter going forward.”

Looking ahead, Douglas said UNFI has realized its “tech roadmap” needs to be more closely linked to the capabilities of its customers “so that one plus one equals three… it’s a basic strategy in terms of sophisticated customer relationships, so that our entire network is as competent, effective and efficient as possible.”

“We’ve learned some things that we’re going to share with all of [our customers], because they also are in the cyber security business,” Douglas told analysts. “I think it’ll go both ways from a value creation standpoint, and fits underneath our strategy to create value for customers as a core means of earning their business every day.”