Recommended Free Tools
Short answer: United Natural Foods, Inc. (UNFI) experienced unauthorized activity on June 5, 2025, and temporarily took some information-technology systems offline. The disruption affected electronic ordering, receiving, invoicing, fulfillment and distribution, contributing to empty shelves at some retailers, including Whole Foods locations and 53 Defense Commissary Agency stores. UNFI said its core customer- and supplier-facing systems were restored on June 26, 2025. This was a temporary 2025 distribution disruption—not an ongoing nationwide grocery shortage in August 2026.
What UNFI does—and why its outage reached grocery stores
UNFI is a major grocery wholesaler serving retailers in the United States and Canada. It distributes fresh, natural, organic, conventional and non-food products. TechCrunch reported that UNFI served more than 30,000 stores across the two countries.
As an Amazon Associate I earn from qualifying purchases.
UNFI is the distributor, not the owner or operator of every store that buys from it. Whole Foods is a retailer that, in the context of the 2025 reporting, relied on UNFI as its primary distributor for relevant supplies. Other UNFI customers include independent grocers, grocery chains and government commissaries. A problem at the distributor could therefore affect many separate businesses without every store being affected in the same way.
The original breaking-news report is available from TechCrunch. The company’s subsequent disclosures provide a fuller recovery and financial timeline.
What happened: the timeline
| Date | What happened |
|---|---|
| June 5, 2025 | UNFI detected unauthorized activity on certain IT systems, activated its incident-response plan and took some systems offline. Its initial SEC disclosure described the operational response. |
| June 9 | UNFI publicly acknowledged the unauthorized activity, said it had notified law enforcement and described efforts to restore systems. |
| June 15–17 | Electronic ordering and receiving capabilities were progressively restored, but some stores continued to report shortages, delayed shipments or difficulty placing orders. |
| June 21 | UNFI filed a material-cybersecurity-incident update with the SEC. |
| June 26 | UNFI said its core retail-customer and supplier systems had been safely restored and deliveries were returning to more normalized levels. The company’s systems-update archive records the recovery statements. |
| July 16 | UNFI estimated the incident’s fiscal 2025 effects on sales, net income and adjusted EBITDA. |
| August 2 | UNFI’s fiscal-year filing reported approximately $26 million in incremental incident costs and described the event’s broader operational and financial effects. |
How a cyber incident can empty a grocery shelf
The incident did not destroy the national food supply. It disrupted a major distribution and replenishment layer:
Retailer order → UNFI electronic systems → warehouse allocation → shipment → store receiving → shelf replenishment
Retailers normally submit orders electronically. The distributor then uses connected systems to process those orders, coordinate warehouse activity, generate invoices, arrange deliveries and record receiving transactions. When systems are taken offline for containment, that automated flow can be interrupted even if products remain physically available in a warehouse.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- A store may be unable to place its normal order or may have to use a manual workaround.
- Warehouse staff may have less efficient tools for allocation, picking and shipping.
- Deliveries may be delayed, incomplete or harder to reconcile at the store.
- The retailer may substitute another distributor, ration inventory or wait for the next delivery cycle.
- Fast-moving and perishable products can show gaps quickly when a scheduled replenishment is missed.
UNFI said it used business-continuity workarounds where possible and gradually restored ordering and receiving functions. But technical recovery at the distributor did not mean that every store instantly had a full truck, a complete order or normal inventory levels.
Which stores were affected?
Verified reports identified Whole Foods locations, other UNFI-dependent grocery businesses and 53 Defense Commissary Agency stores. The 53-store figure came from a DeCA spokesperson quoted by TechCrunch.
The effects varied by location. Some retailers found replacement supplies through other distributors; others reported continuing ordering or shipment problems. There is no evidence that every Whole Foods store, every UNFI customer or every region experienced identical shortages. The “more than 30,000 stores” figure describes UNFI’s reported customer reach—not the number of stores that ran out of products.
Rank #3
How long did the disruption last?
The most severe systems outage began after June 5. UNFI was making progress with electronic ordering and receiving by June 15, and it reported core systems restored on June 26. Retail-level effects continued beyond the initial outage for some businesses because stores still had to replenish depleted inventory and work through delayed or incomplete orders.
Natural Grocers later said shortages connected to the UNFI incident affected its June and July 2025 operations. In a filing, it estimated that the disruption reduced second-quarter fiscal 2025 sales by approximately $3.5 million to $4 million. A later filing said Natural Grocers recognized a $2 million business-interruption-insurance recovery gain in April 2026 related to the event.
What UNFI confirmed—and what it did not
| Publicly supported | Not established by the cited disclosures |
|---|---|
| Unauthorized activity on certain systems | The malware family or detailed attack path |
| Some systems were taken offline for containment | The identity of a threat actor |
| Law enforcement and outside cybersecurity or forensic experts were involved | Whether a ransom was demanded or paid |
| Disruption to ordering, receiving, invoicing and distribution operations | That the incident was ransomware |
| Core systems were restored by June 26, 2025 | The volume of data allegedly exfiltrated |
| Material sales, profit and incident-cost effects | Whether personal information was accessed or stolen |
These distinctions matter. “Unauthorized activity,” “a systems outage,” “a cyberattack,” “ransomware,” “a data breach” and “data exfiltration” are not interchangeable terms. UNFI’s cited public notices described unauthorized activity and operational disruption but did not establish that personal information had been stolen.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What did the incident cost?
On July 16, 2025, UNFI estimated that the incident would reduce fiscal 2025 net sales by approximately $350 million to $400 million, net income by approximately $50 million to $60 million, and adjusted EBITDA by approximately $40 million to $50 million. These were company estimates, not a claim that the entire sales range represented cash permanently lost.
UNFI’s fiscal 2025 annual filing later reported approximately $26 million in incremental incident costs and described an adverse adjusted-EBITDA effect of approximately $50 million. The July 16 earnings-release exhibit and the annual filing should be read together because one presents estimates while the later filing records the company’s fiscal-year reporting.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Retailers also bore consequences. Natural Grocers’ reported sales effect illustrates how a distributor outage can create losses for downstream companies even after the distributor’s systems are back online.
Best Value
What shoppers should infer from an empty shelf
- Check another location. A stockout at one store may reflect that store’s distributor delivery or ordering problem rather than a regional shortage.
- Ask the store directly. Employees may know whether a shipment is delayed, whether the product is awaiting replenishment or whether the retailer has changed suppliers.
- Distinguish availability from price. The evidence supports stockouts, delayed deliveries and reduced availability. It does not establish that the incident caused a nationwide price spike.
- Do not treat an online inventory indicator as definitive. Systems can lag behind physical inventory during an operational disruption.
- Plan ahead for essentials. For infant formula, medication or other critical products, contact the retailer before relying on a listed delivery date or store count.
The broader supply-chain lesson
The UNFI incident shows how concentration and digital dependence can amplify a disruption. A retailer with several distributors may be able to shift orders more quickly than a store that depends heavily on one wholesaler. Independent grocers may have fewer substitution options or less negotiating leverage than larger chains.
Manual procedures can keep some deliveries moving, but they generally reduce speed, visibility and processing accuracy. Retailers also need time to rebuild normal inventory after systems return. That is why “core systems restored” and “every shelf fully stocked” are different milestones.
The event does not prove that the entire national food system was insecure or that every grocery chain faced the same risk. It demonstrates a narrower point: a cyber incident at an important wholesaler can create localized or chain-specific shortages without a nationwide shortage of the underlying food.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsCurrent status
As of August 18, 2026: UNFI’s core customer- and supplier-facing systems were reported restored on June 26, 2025. The incident remains relevant as a supply-chain cybersecurity case study, and its financial effects were documented after the operational recovery. The phrase “UNFI is recovering” belongs to the June 2025 news context; it should not be read as a current bulletin saying that UNFI is still experiencing the same outage.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
