###

A recent cyberattack on United Natural Foods, Inc. (UNFI) is disrupting grocery supply chains across the United States, causing widespread shortages of mass-produced frozen foods and other pantry staples. 

While the scale of the security breach remains unknown, the Outpost has received confirmation that at least two local grocery chains have been affected, including all five Murphy’s Markets and the Chef’s Store in Eureka. 

“Fortunately, we got on it immediately,” John McClurg, deli supervisor for Murphy’s Markets, told the Outpost. “I went over to the Chef’s Store and bought a ton of produce because, at first, nobody really knew anything. We just knew that there had been a [cyber] attack and that [UNFI] had to reboot their system. They couldn’t receive any phone calls, and their computers were down. The first analysis indicated that they were going to be out until next week.”

UNFI officials noticed the security breach late last week after “unauthorized activity” was detected in its system. “We are assessing the unauthorized activity and working to restore our systems to safely bring them back online,” UNFI officials wrote in a statement issued on Monday. “As we work through this issue, our customers, suppliers, and associates are our highest priority. We are working closely with them to minimize disruption as much as possible.”

As more information began trickling in, it became apparent that metropolitan areas — especially cities with Whole Foods Markets, which has a primary distribution agreement with UNFI —  would bear the brunt of the attack and subsequent food shortages. 

“We — and by ‘we’ I mean Humboldt County — have fared better because we have a lot of smaller, locally-based distributors that we go through that weren’t affected by [the attack on] UNFI,” McClurg said. “I talked to a friend in New York who handles food distribution, and he said it’s just an absolute zoo in the city right now. This is one of the few times it pays to be in a smaller area like Humboldt County, where pretty much everyone I know can supplement their losses through other vendors.”

That said, you might have a hard time finding some of your favorite cereals and frozen treats at Murphy’s Markets for the next few days.

“You might not see your Stouffer’s or your Marie Callender’s pot pies … but you’re going to be fine with essentials,” McClurg said. “This is not a panic buy situation. If you had your heart set on Stouffer’s mac and cheese, you might not find it at our store.”

[CLARIFICATION: After publication, McClurg reached out to the Outpost to clarify that the name-brand items currently out of stock are expected to arrive in a delivery on Friday and should be back on shelves this weekend.]

In an emailed response to the Outpost’s inquiry, Sara Matheu, a spokesperson for the Chef’s Store, confirmed that one of its “third-party suppliers” recently experienced a “temporary supply chain disruption, which has temporarily impacted some scheduled product deliveries.” However, she did not identify the third-party supplier by name. 

“Our Eureka [Chef’s Store] customers remain our top priority, and we are implementing measures to mitigate potential product disruptions,” Matheu said.

In a written statement issued this morning, UNFI said the investigation into the security breach is ongoing. 

We continue working steadily to safely restore our systems and provide the services our customers and suppliers know and expect from us. As of today, we’re gradually bringing our ordering and receiving capabilities back online, with the goal of further increasing our capacity over the coming days. The investigation is ongoing with the support of leading forensics experts. Our customers, suppliers, and associates are our highest priority. We continue to work closely with them to minimize disruptions as much as possible.

Reached for additional comment, store managers at Ray’s Food Place in Arcata and WinCo in Eureka said they were not aware of the cyber attack. The North Coast Co-op and Eureka Natural Foods did not respond to our request for comment before publication. We’ll update this post if we hear back.