JBS Ransomware Attack Started in March and Much Larger in Scope than Previously Identified

SecurityScorecard investigated a REvil/Sodinokibi ransomware campaign against JBS, reporting reconnaissance in February 2021, repeated data exfiltration between March and May (≈45 GB to MEGA and up to 5 TB to hosts in Hong Kong), leaked employee credentials, persistent TeamViewer access, and encryption on June 1; the report attributes activity to REvil, documents related indicators (RDP probes, malicious source IPs), and highlights systemic cybersecurity hygiene issues across the food industry.