8-K: United Natural Foods Discloses Material Financial Impact from Cybersecurity Incident

United Natural Foods, Inc. (UNFI) announced that a recent cybersecurity incident is reasonably likely to materially impact its fourth fiscal quarter 2025 net income and adjusted EBITDA, despite having contained the unauthorized activity and restored core systems.

Summary

• UNFI became aware of unauthorized activity on certain IT systems on June 5, 2025, which was previously disclosed on June 9, 2025.
• The company promptly activated its incident response plan, implementing containment measures including proactively taking certain systems offline, which temporarily impacted customer order fulfillment and distribution.
• The unauthorized activity has since been contained, and core systems for electronic ordering and invoicing have been safely restored, leading to normalized business operations.
• The incident did not involve a breach of personal or protected health information, and no notifications to individual consumers are anticipated.
• In the weeks following the incident, UNFI experienced reduced sales volume and increased operational costs.
• Management believes the incident is reasonably likely to have a material impact on the company's net income/(loss) and adjusted EBITDA for the fourth fiscal quarter of 2025, compared to prior internal projections.
• UNFI holds cybersecurity insurance that it expects will be adequate for the incident, with the full claim and settlement process anticipated to extend into its 2026 fiscal year.
• The company plans to provide an updated financial outlook for the remainder of fiscal year 2025 in July.
• As of the filing date, UNFI does not expect the incident to materially impact its financial condition or ability to achieve longer-term strategic and financial objectives.

Sentiment

Score: 6

Explanation: The document discloses a material negative impact on Q4 fiscal 2025 net income and adjusted EBITDA due to a cybersecurity incident, which is a clear negative. However, the incident has been contained, core systems restored, no personal data was breached, and the company expects adequate insurance coverage and no material impact on long-term objectives, which are significant mitigating factors.

Positives

• The unauthorized activity on IT systems has been contained.
• Core IT systems for customer and supplier electronic ordering and invoicing have been safely restored, enabling business operations to normalize.
• The incident did not involve a breach of personal information or protected health information, and no consumer notifications are anticipated.
• The company holds cybersecurity insurance that it currently expects will be adequate for the incident.
• Management does not expect the incident to have a material impact on the company's financial condition or its ability to achieve previously disclosed longer-term strategic and financial objectives.
• The company reported strong operating results through the third quarter of fiscal 2025.

Negatives

• The cybersecurity incident temporarily impacted the company's ability to fulfill and distribute customer orders.
• In the weeks following the incident, the company experienced reduced sales volume.
• The company incurred increased operational costs as a result of the incident.
• The company has incurred, and expects to continue to incur, direct expenses related to the investigation and remediation of the incident.
• Management believes the incident is reasonably likely to have a material impact on the company's net income/(loss) for the fourth fiscal quarter of 2025 compared to internal projections.
• Management believes the incident is reasonably likely to have a material impact on the company's adjusted EBITDA for the fourth fiscal quarter of 2025 compared to internal projections.

Risks

• Ongoing assessment and investigation of the cybersecurity incident.
• Adequacy of the company's response and effectiveness of its business continuity plans.
• Magnitude of the potential disruption to the company's business and operations.
• Legal risks resulting from the incident.
• Regulatory risks resulting from the incident.
• Reputational risks resulting from the incident.
• Financial risks resulting from the incident, beyond the currently anticipated material impact on Q4 FY2025.
• Actual results could differ materially from forward-looking statements due to various factors, including those described in the company's Annual Report on Form 10-K.

Future Outlook

The company intends to provide an update on its financial outlook for the remainder of fiscal year 2025 in July, which is expected to reflect strong operating results through the third quarter of fiscal 2025 and performance in the fourth quarter, including the anticipated quantitative impact of the cybersecurity incident. Despite the short-term impact, the company does not expect the incident to have a material impact on its financial condition or its ability to achieve previously disclosed longer-term strategic and financial objectives.

Management Comments

• "Management believes that the incident is reasonably likely to have a material impact on the Company's net income/(loss) and adjusted EBITDA for the fourth fiscal quarter of 2025 compared to its internal projections prior to the incident."
• "The Company holds cybersecurity insurance that it currently expects will be adequate for the incident."
• "The Company does not expect that the incident described above in Item 1.05 will have a material impact on its financial condition or its ability to achieve its previously disclosed longer-term strategic and financial objectives."

Industry Context

The cybersecurity incident experienced by United Natural Foods, Inc. highlights the increasing vulnerability of supply chain and distribution companies to cyber threats. Such incidents can disrupt critical operations, leading to temporary sales reductions and increased costs, underscoring the importance of robust cybersecurity measures and incident response plans across the industry to maintain operational continuity and financial stability.

Stakeholder Impact

• Shareholders: Potential negative impact on Q4 FY2025 financial results (net income, adjusted EBITDA) and potential for increased expenses.
• Customers: Experienced temporary disruption in order fulfillment and distribution, followed by restoration of electronic ordering and invoicing systems.
• Suppliers: Experienced temporary disruption in electronic invoicing systems, followed by restoration.
• Employees: Implied operational adjustments and efforts to drive solutions-oriented results during and after the incident.

Next Steps

• Provide an update on the financial outlook for the remainder of fiscal year 2025 in July.
• Continue the full claim and settlement process for cybersecurity insurance, expected to extend into fiscal year 2026.
• Continue to closely monitor the effect of the incident on its business, financial condition, and results of operations.

Key Dates

Recommendation

Keywords

UNFI, United Natural Foods, cybersecurity incident, data breach, IT systems, supply chain disruption, financial impact, 8-K filing, distribution network, adjusted EBITDA, net income, operational costs