Empty shelves at grocery stores across the Twin Cities have triggered pandemic flashbacks over the past week, but this time a cyberattack is to blame.

United Natural Foods Inc. (UNFI), a major wholesale distributor based in Rhode Island, last Monday reported there’d been “unauthorized activity” on some of its IT systems. Noticing this June 5, it “promptly activated its incident response plan,” according to a company filing. This involved taking its food-delivery platform offline, and that meant retailers couldn’t place orders.

Shoppers have noticed. Some on social media have posted images of spotty shelves. Grocers nationwide are dealing with stock issues. UNFI has plied workarounds, including manual processing and fulfillment, according to press releases. Nearly two weeks since the cyberattack, it has a temporary, and subpar, online ordering system in place.

“We’re rooting for UNFI,” says Jill Holter, marketing director for the Wedge co-op in Minneapolis, which sources goods from UNFI. “You can imagine how badly they are hurting.”

The company conducts roughly $600 million in sales a week, distributing groceries to more than 30,000 locations in North America. UNFI acquired Cub, based in Stillwater, in 2018. Other big chain retailers—Whole Foods, Kowalski’s, and Lunds & Byerlys—also depend on UNFI.

The company has been in cleanup mode, “working actively to assess, mitigate, and remediate the incident with the assistance of third-party cybersecurity professionals,” according to the filing.

UNFI has stated pharmacy closures at Cub were resolved last Wednesday, as reported by CBS News.

And on Sunday, in its latest release, the distributor reported it was “receiving orders and delivering products to grocery store customers across North America” while continuing to restore its electronic systems. (On Wednesday at noon, the Cub in St. Louis Park had noticeable gaps but didn’t look catastrophic.)

Smaller grocers feel the hit, too. “[UNFI] is a super important partner for us,” says Holter, of the Wedge. Thirty-five percent of the co-op’s sales come from UNFI-delivered goods, she says. Most depleted right now are center-store items—largely, packaged products—plus dairy, especially yogurt.

Holter felt the national resonance last week visiting co-ops and farms in the Pacific Northwest for work: “It’s all anyone’s talking about.”

Ted Spreigl owns Tim & Tom’s Speedy Market, a corner grocer on Como Avenue in St. Paul’s St. Anthony Main Park neighborhood. He’s also seen a blow to the dairy and frozen categories, especially ice cream.

Tim & Tom’s lost access to UNFI’s online portal the weekend of June 7. “It already feels like it started so long ago,” Spreigl says. He learned Sunday of the cyberattack, and distribution has come in fits and starts, with an ice cream order making it through this past Monday.

Like Holter, Spreigl has had success duplicating orders from before the shutdown, although those aren’t always the orders he needs. “I think it’s less stress on their system,” he says. Overall, “it’s been a mess.”

UNFI’s temporary system is working, Holter notes, although it’s noticeably diminished. “It’s not as precise,” she says. “We don’t have as much level of detail. There’s a little bit more work on our end.”

Don’t Burn Bridges

Retailers like the Wedge and Tim & Tom’s appear to have an advantage over bigger stores: They can count on smaller supply chains, with direct links to vendors and secondary distributors.

“The larger retailers that are much more dependent on UNFI—that’s where we saw those shelves that looked like something we’d all like to forget,” Holter says, referring to pandemic shortages. “We [as a co-op] can make phone calls and move quickly to get stuff on our shelves.”

The Wedge has individual relationships with smaller farmers who prefer to deliver directly to retailers, Holter says. “So, we have that ability to get on the phone or send an email and say, ‘Hey, we’re scrambling for lettuce,’ or, ‘We need heirloom tomatoes.’”

More crucially, the Wedge works closely with a co-op hub, Co-op Partners Warehouse (CPW). The St. Paul-based organic distributor operates under the Twin Cities Co-op Partners company, as do the Wedge’s two locations, in Linden Hills and on Lyndale. “Lucky us, that [CPW] is one of our business units,” Holter says. “We have that direct relationship.”

CPW had its biggest sales week ever last week, she says. It has filled gaps for retailers and co-ops—phoning farms, sourcing brands quickly to cover UNFI categories. “There are people that don’t typically order from CPW that have reached out to us and said, ‘Hey, can you help us out?’”

CPW, which is the Wedge’s primary source of produce, sells to more than 400 restaurants, co-ops, and natural food stores in the Midwest. It conducts more than $40 million in sales annually—tiny, compared to UNFI. But CPW was able to bulk up purchase orders last week without creaking under new demand, Holter says.

Similarly, Tim & Tom’s is faring well compared to grocers like Cub and Whole Foods, according to Spreigl. “UNFI’s their main grocery provider … but I work with three other grocery distributors that can help fill in the gaps”—namely, the Illinois-based Kehe, the Michigan-based Lipari, and the Minnesota-based Mason Brothers.

One clear lesson: “Don’t burn bridges with vendors,” Spreigl says. “I can work with so many other people because we have good relationships with our distributors.”

The co-op response is driving traffic. Holter notes “strong sales” and says customers have actually been thanking the Wedge for filling the gaps. Spreigl, too, has noticed a bump in business, recalling Covid days when Tim & Tom’s did “a fantastic job” stocking essentials.

It’s resulting in a perk for Wedge shoppers: “Because of this problem at UNFI, we’ve extended our weeklong, quarterly 10%-off [discount] to go through the end of the month,” Holter says.

Still, it feels vulnerable to realize how much balances on one company—“and how many grocery stores and consumers are going to be affected by this one cyberattack,” she says.

On Tuesday, Spreigl and Holter heard from UNFI that its platform should be back online by week’s end. But Spreigl notes that was last week’s timeframe, too. “I think this is really giving everyone, for lack of a better phrase, a kick in the ass, in making sure everything’s secure,” he says. “This is a very modern problem, right?”