Latest / The Operator's Manual with Fexingo: Daily Decisions, Tactical Wins, and Business Execution / Inside JBS Ransomware Playbook
Transcript
- Lucas: May 30, 2021. A Saturday. JBS, the world's largest meat processor, starts seeing alerts across its internal systems in North America and Australia. By Sunday morning, production has stopped at fourteen plants. The company that produces nearly a fifth of America's beef supply is completely offline. Luna: And this wasn't a drill scenario. This was real, unfolding in real time, with livestock in holding pens and contracts to fulfill. Lucas: Right. The operational stakes were enormous. JBS processes about 20 percent of US beef and a similar share of pork. Every day of downtime meant millions in lost revenue, but more importantly, it meant disrupting the entire food supply chain — feedlots, grocery stores, export terminals. The clock was ticking in a very physical way. Luna: So what did they do first? I imagine the initial hours were chaos. Lucas: According to the post-incident reports and interviews with executives, the first move was to isolate the compromised systems and bring up their offline backups. JBS had a disaster recovery plan, but like most plans, it looks great on paper until you're actually executing it under pressure. The IT team worked through the weekend to rebuild core servers from tape backups — old-school, but effective when ransomware encrypts your primary environment. Luna: Tape backups. That's almost retro. But it's exactly the kind of thing that saves you when the digital infrastructure is gone. Lucas: Exactly. And here's where the decision tree got really interesting. By Sunday evening, executives had a choice: negotiate with the attackers and potentially pay a ransom, or refuse and try to restore everything from scratch, which could take weeks. The attackers had already demanded eleven million dollars in Bitcoin. Luna: Eleven million. That's a big number, but for a company doing about fifty billion in annual revenue, it's a rounding error. The real cost was the downtime. Lucas: That's exactly the calculation. JBS's CEO at the time, a guy named Gilberto Tomazoni, later said the decision to pay was purely operational. He didn't want to play into a moral debate about funding criminal networks — though that's a real concern. He said, 'We paid because we had to protect our customers and our employees.' The ransom was about speed of recovery, not ideology. Luna: And let's be clear: paying doesn't guarantee you get your data back. But in this case, the attackers actually provided a working decryption tool. JBS used it, and within days, most plants were back online. Lucas: Right. By Wednesday, 72 hours after the initial attack, JBS had resumed operations at all its US facilities. That's remarkably fast. The combination of paying the ransom and having a solid backup strategy allowed them to recover in days, not months. Luna: So what did they learn from this? I'm guessing they didn't just pay and move on. Lucas: No, and this is the part that makes it a real case study. JBS invested heavily in what they called a 'defense-in-depth' approach after the attack. They segmented their network, implemented multi-factor authentication across the board, and established a dedicated cyber operations center. But the most interesting change was cultural: they started running regular 'tabletop exercises' where executives simulate a ransomware attack and have to make decisions in real time. Luna: So the playbook wasn't just technical. It was about decision-making under pressure, which is exactly what this show is about. Lucas: If these conversations have moved your work forward in some small way, consider supporting the show. It keeps us ad-free and focused on the cases that actually matter. You can find us at buy me a coffee dot com slash fexingo. Luna: Yeah, it's a low-key way to back the kind of business analysis you don't hear everywhere. And we appreciate it. Lucas: So back to JBS. One of the key tactical decisions they made was to not negotiate on the attackers' timeline. They used the FBI as a resource — not just for investigation, but for strategic advice on how to handle the ransom payment. The FBI's official stance is 'don't pay', but in practice, they understand that companies sometimes have to. Luna: Did the FBI help them with the actual Bitcoin transaction? I remember that being a complicated part. Lucas: Yes. The FBI doesn't facilitate payments, but they provided guidance on how to structure the transaction to minimize the risk of the funds being traced to other criminal activity. JBS also worked with a third-party ransomware negotiation firm, which is almost standard practice now. These firms handle the communication with attackers and manage the cryptocurrency transfer. Luna: So it's almost become a specialized industry. Ransomware negotiation as a service. Lucas: Exactly. And the numbers back it up. According to a 2023 report from the cybersecurity firm Coveware, the average ransom payment has actually been declining — from about $800,000 in 2021 to around $400,000 in 2024. But that's partly because companies are getting better at backups and recovery, so attackers are forced to demand lower amounts to make payment seem worthwhile. Luna: But JBS's eleven million was way above average. It was a targeted, high-value attack. They knew exactly who they were hitting. Lucas: That's the other lesson: JBS was targeted specifically because of its critical role in the food supply chain. Attackers research their victims. They look for companies that cannot afford downtime, that have regulatory pressures, that serve essential needs. JBS ticks every box. So the takeaway for any business leader is: if you're in a critical infrastructure sector, you're not a random target. You're a priority target. Luna: And that means your playbook needs to be specific to your risk profile. A small retailer might have a different response than a meat processor. Lucas: Right. So what does a good playbook look like? Based on JBS's experience and a lot of post-incaut analysis, there are four pillars. First, offline backups — not just cloud backups that are accessible from the network. You need tapes or immutable storage that cannot be encrypted from inside the environment. Luna: Second, a communication plan. Who talks to the FBI? Who talks to customers? Who talks to the press? In JBS's case, they had the CEO front and center, which was smart. Lucas: Third, a financial contingency. Whether you decide to pay or not, you need to have a process for acquiring cryptocurrency quickly, and you need legal counsel who understands the Office of Foreign Assets Control — OFAC — implications. Paying a sanctioned entity can get you in serious regulatory trouble. Luna: And fourth, the tabletop exercises we mentioned. You have to practice making these decisions before the attack happens. Lucas: Exactly. JBS now runs two major cyber exercises per year, and they include not just IT, but legal, communications, supply chain, and even plant-level operations managers. Because the decision to shut down a plant isn't just an IT decision. It's an operations decision. Luna: I want to go back to the payment itself. Eleven million in Bitcoin. How did they even get that much crypto quickly? That's not something you can just wire from your corporate bank account. Lucas: Good question. They worked with a crypto liquidity provider — essentially a firm that can source large amounts of Bitcoin on short notice. The transaction happened within hours. The attackers provided a wallet address, JBS transferred the funds, and within about 24 hours, they received the decryption tool. Speed matters because attackers sometimes get spooked or move on. Luna: So the operational tempo of the ransom payment itself is a factor. The faster you can pay, the faster you get your data back. But that creates its own pressure. Lucas: And that's why having the playbook ready before the attack is crucial. You don't want to be googling 'how to buy Bitcoin' while your plants are down. JBS had a retainer with a negotiation firm and pre-established relationships with liquidity providers. That's the kind of prep that separates a smooth recovery from a chaotic one. Luna: What about the longer-term impact on JBS's operations? Did they change how they run plants day-to-day? Lucas: Yes. One of the most visible changes is that they moved to a 'zero trust' network architecture in their plants. Previously, many of their industrial control systems were on flat networks — meaning if an attacker got into one system, they could move laterally to others. Now they've segmented plant networks so that even if a cyber attack hits the corporate IT side, the actual processing lines can continue operating in a degraded mode. Luna: That's a huge operational shift. It means they're decoupling the digital business layer from the physical production layer. Lucas: Exactly. And it's expensive. But the cost of a single day of downtime at a major beef plant is estimated at around $10 million. So the investment pays for itself quickly if it prevents even one major incident. Luna: So the JBS case is really a story about trade-offs. Paying the ransom was a tactical decision that prioritized speed over principle. But the strategic response was about building resilience so that future attacks wouldn't force that same choice. Lucas: Right. And I think that's the enduring lesson for any business leader. You can't prevent every attack, but you can design your operations to recover fast. The companies that survive ransomware aren't the ones with perfect security. They're the ones with fast recovery. Luna: And a plan for when the worst happens. Because it will happen to someone. Maybe to you. Lucas: And when it does, you want to be the company that gets back online in 72 hours, not the one that's still arguing about whether to pay while your supply chain falls apart.