Business Context and Reporting Period
Company: United Natural Foods, Inc. (UNFI)
Filing Type: Form 8-K (Current Report)
Date of Report: June 21, 2025
Reporting Period: Update regarding a material cybersecurity incident initially detected on June 5, 2025, and its impact on the fourth fiscal quarter of 2025.
Key Financial Metrics
This filing does not provide specific numerical values for revenue, profit, cash flow, margins, debt, or liquidity. The document focuses on the qualitative and projected financial impact of a cybersecurity incident.
- Impact on Net Income/Adjusted EBITDA: Management believes the incident is reasonably likely to have a material impact on net income/(loss) and adjusted EBITDA for the fourth fiscal quarter of 2025 compared to internal projections.
- Operational Costs: The Company experienced increased operational costs in the weeks following the incident.
- Sales Volume: Reduced sales volume was experienced in the weeks following the incident.
- Insurance: The Company holds cybersecurity insurance expected to be adequate for the incident; the claim and settlement process is expected to extend into fiscal year 2026.
Material Changes Versus Prior Period
Compared to the period prior to the incident:
- Operations: The Company temporarily took certain systems offline, impacting the ability to fulfill and distribute customer orders. Core systems for electronic ordering and invoicing have since been restored, and business operations have normalized.
- Financial Performance: The Company incurred direct expenses related to investigation and remediation. Reduced sales volume and increased operational costs were observed in the weeks immediately following the June 5, 2025 detection.
- Outlook: Internal projections for the fourth fiscal quarter of 2025 have been negatively impacted by the incident.
Guidance, Outlook, and Risks
Management Commentary and Outlook:
- The Company intends to provide an update on its financial outlook for the remainder of fiscal year 2025 in July, reflecting strong operating results through the third quarter and the anticipated quantitative impact of the incident in the fourth quarter.
- Management does not expect the incident to have a material impact on the Company's overall financial condition or its ability to achieve previously disclosed longer-term strategic and financial objectives.
- No notifications to individual consumers are anticipated as the incident did not involve a breach of personal information or protected health information.
Risks and Contingencies:
- Cybersecurity Incident: Ongoing investigation and remediation costs; potential legal, regulatory, and reputational risks.
- Forward-Looking Statements: Actual results could differ materially due to the magnitude of disruption, effectiveness of business continuity plans, and the outcome of the investigation.
Important Facts for Investor Verification
- Verify the specific quantitative impact on Q4 2025 net income and adjusted EBITDA when the July financial outlook update is released.
- Monitor the status of the cybersecurity insurance claim and settlement process extending into fiscal 2026.
- Confirm that business operations have fully normalized and that no further disruptions to the distribution network occur.
- Review the Company's 10-K filing for the year ended August 3, 2024, for detailed risk factors related to cybersecurity.