The Meat That Stopped

Not a labor dispute. Not equipment failure. Not a regulatory shutdown. JBS SA — which at the time handled roughly a quarter of US beef capacity and significant fractions of pork and chicken — went dark because ransomware encrypted their systems and a Russian criminal group called REvil was waiting for payment before handing over the decryption keys.

The ransom was $11 million in Bitcoin. JBS paid it. Plants in the US, Australia, and Canada came back online. The beef supply resumed. The story effectively ended there, because paying works.

This happened eight days after Colonial Pipeline paid DarkSide $4.4 million to restore fuel distribution on the East Coast. Two major pieces of physical infrastructure, grounded in two weeks, ransomed back to operational status. The Colonial Pipeline payment got presidential attention, FBI follow-up, and an unusual partial recovery of the ransom. The JBS payment got a statement, an FBI attribution, and a return to normal.

The gap in response says something about what "critical infrastructure" actually means in practice: pipelines get the drama because Americans panic about gas prices. Meat processing is just as critical — try running a supermarket without it — but it doesn't produce the same visible disruption at the consumer end. JBS paid, the beef flowed, and most people who heard about it moved on.

REvil was a ransomware-as-a-service operation based in Russia, meaning they ran attacks directly and licensed their malware to affiliates who ran their own campaigns. They were prolific. The US government eventually pressured Russia; Russia eventually arrested several members in January 2022 — a year and a half after the JBS attack — in a display of law enforcement cooperation that felt more performative than consequential. Ransomware groups reconstitute. Tools get reused. The operators move to the next operation.

What the JBS attack illustrated is the architecture of the problem. A slaughterhouse is not, at its core, a digital operation. It is a very large, very physical process involving animals, workers, refrigeration, and transportation logistics. But like every industrial operation over the past two decades, it has been progressively digitized: scheduling systems, floor controllers, network-connected equipment, centralized IT infrastructure. The efficiency gains from that digitization are real and significant.

So are the new attack surfaces.

Ransomware doesn't need to understand meat. It needs a way into the network — a phishing email, an unpatched VPN appliance, a vendor connection with inadequate segmentation — and it needs the target's backup situation to be bad enough that paying is cheaper than waiting. JBS's calculation took about four days: $11 million versus the ongoing cost of idle plants, spoilage, worker shutdowns, and customer contracts at risk.

The math was not complicated.

This is critical infrastructure in the current threat environment: large organizations running essential physical processes on enterprise IT that wasn't designed for this threat model, connected to networks that aren't adequately segmented, with backups that are either absent or can't be restored fast enough to change the ransom calculus. The attackers know this. They size the ransom accordingly.

JBS paid. The beef supply resumed. Nothing structural changed. The ransomware groups noted that the playbook worked again.