Last fall’s ransomware attack at pork and poultry packer Maple Leaf Foods led to an “adverse economic impact” of $23 million or more on the company’s bottom line as it worked to restore systems, officials said.
The company on Thursday released that estimate as part of its fourth-quarter financial report, in which it booked a Q4 net loss of $41.49 million on $1.186 billion in sales and a full-year net loss of $311.89 million on $4.739 billion in sales.
During its fourth quarter, on Nov. 6, 2022, Mississauga-based Maple Leaf confirmed it was hit with a “system outage stemming from a cybersecurity incident.”
Read Also
Trump tariff on Brazilian goods could jack up U.S. burger price
U.S. President Donald Trump’s plan for a 50 per cent tariff on goods from Brazil will likely raise prices for the beef that is used in American hamburgers, traders and analysts said on Thursday, as food manufacturers increasingly rely on imports during a time of declining domestic production.
In Thursday’s report, the company reiterated it “took immediate action and engaged cybersecurity and recovery experts” upon learning of the attack, and “executed its business continuity plans” as it restored affected systems.
Maple Leaf said it was able to maintain operations throughout the event and work with customers and suppliers to “minimize service disruptions,” but nevertheless, its “normal business activities were interrupted.”
With that came the expenses of “system restoration costs, lost sales, overtime, spoiled inventory” and professional fees paid to its experts, the company said.
The company on Thursday estimated fourth-quarter “direct and indirect economic impact” of “at least” $23 million relating to the incident.
Maple Leaf also said it expects to recover some of those costs through related insurance payouts later in 2023. CEO Michael McCain said those amounts can’t yet be booked into the company’s financial results but the company is “very confident” it will be able to recoup some of those costs.
Asked Thursday about the nature of the cybersecurity attack, a company spokesperson said via email the attackers in this case “did try to extort a ransom from us and we refused to pay.”
Maple Leaf in November reported “operational and service disruptions that vary by business unit, plant and site.”
The company’s operations in Canada include hog slaughter plants at Brandon, Man. and Lethbridge, Alta.; five fresh poultry plants in Ontario and one at Edmonton; hatcheries in Ontario and Alberta; five feed mills in Manitoba; and pork and poultry further-processing sites in five provinces. The company recently opened a major new poultry plant at London, Ont.
As for its livestock production, “our farms have adjusted their practices due to the system outage, and we feel confident in our ability to care for our animals and meet their needs,” Maple Leaf said at the time.
On a call with market analysts Thursday, McCain said the $23 million estimate reflects a combination of “incremental” costs incurred as a result of the company’s “entire team” shifting its focus to deal with the incident.
Within less than 48 hours of the attack being discovered, he said, staff were able to shift operations to “fully manual… essentially paper-and-pencil” while company information systems were cleaned and rebooted.
While the company didn’t use the word in its report, the nature of the attack points to ransomware — a form of malware that either encrypts a targeted computer system’s files, rendering them unusable, or removes a system’s sensitive data.
A ransom, usually payable in cryptocurrency, is then demanded of the system’s owner, in exchange for a decryption key or the missing data.
Maple Leaf’s outage isn’t the first ransomware attack in Canada’s meat packing sector. Canadian operations of Brazilian meat packer JBS briefly halted in the summer of 2021 when that company’s U.S. arm was hit by what was later confirmed to be a ransomware attack.
However, where Maple Leaf says it refused to pay, the CEO of JBS USA later confirmed the company did pay a cryptocurrency ransom equivalent to about US$11 million.
Andre Nogueira was quoted by Reuters at the time as saying “we felt this decision had to be made to prevent any potential risk for our customers.” — Glacier FarmMedia Network
