U.S. says ransomware attack on meatpacker JBS likely from Russia

By Tom Polansek and Jeff Mason

CHICAGO/ABOARD AIR FORCE ONE (Reuters) -The White House said on Tuesday that Brazil’s JBS SA has informed the U.S. government that a ransomware attack against the company that has disrupted meat production in North America and Australia originated from a criminal organization likely based in Russia.

JBS is the world’s largest meatpacker and the incident caused its Australian operations to shut down on Monday and has stopped livestock slaughter at its plants in several U.S. states.

The ransomware attack follows one last month by a group with ties to Russia on Colonial Pipeline, the largest fuel pipeline in the United States, that crippled fuel delivery for several days in the U.S. Southeast.

White House spokeswoman Karine Jean-Pierre said the United States has contacted Russia’s government about the matter and that the FBI is investigating.

“The White House has offered assistance to JBS and our team at the Department of Agriculture have spoken to their leadership several times in the last day,” Jean-Pierre said.

“JBS notified the administration that the ransom demand came from a criminal organization likely based in Russia. The White House is engaging directly with the Russian government on this matter and delivering the message that responsible states do not harbor ransomware criminals,” Jean-Pierre added.

The FBI and Department of Homeland Security did not immediately respond to requests for comment.

JBS sells beef and pork under the Swift brand, with retailers like Costco carrying its pork loins and tenderloins. JBS also owns most of chicken processor Pilgrim’s Pride Co, which sells organic chicken under the Just Bare brand.

If the outages continue, consumers could see higher meat prices during summer grilling season in the United States and meat exports could be disrupted at a time of strong demand from China.

JBS said it suspended all affected systems and notified authorities. It said its backup servers were not affected.

“On Sunday, May 30, JBS USA determined that it was the target of an organized cybersecurity attack, affecting some of the servers supporting its North American and Australian IT systems,” the company said in a Monday statement.

“Resolution of the incident will take time, which may delay certain transactions with customers and suppliers,” the company’s statement said.

The company, which has its North American operations headquartered in Greeley, Colorado, controls about 20% of the slaughtering capacity for U.S. cattle and hogs, according to industry estimates.

“The supply chains, logistics, and transportation that keep our society moving are especially vulnerable to ransomware, where attacks on choke points can have outsized effects and encourage hasty payments,” said threat researcher John Hultquist with security company FireEye.

U.S. beef and pork prices are already rising as China increases imports, animal feed costs rise and slaughterhouses face a dearth of workers.

The cyberattack on JBS could push U.S. beef prices even higher by tightening supplies, said Brad Lyle, chief financial officer for consultancy Partners for Production Agriculture.

Any impact on consumers would depend on how long production is down, said Matthew Wiegand, a risk management consultant and commodity broker at FuturesOne in Nebraska.

“If it lingers for multiple days, you see some food service shortages,” Wiegand added.

Two kill and fabrication shifts were canceled at JBS’s beef plant in Greeley due to the cyberattack, representatives of the United Food and Commercial Workers International Union Local 7 said in an email. JBS Beef in Cactus, Texas, also said on Facebook it would not run on Tuesday.

JBS Canada said in a Facebook post that shifts had been canceled at its plant in Brooks, Alberta, on Monday and one shift so far had been canceled on Tuesday.

A representative in Sao Paulo said the company’s Brazilian operations were not impacted.

‘FOOD SECURITY’

The United States Cattlemen’s Association, a beef industry group, said on Twitter that it had reports of JBS redirecting livestock haulers who arrived at plants with animals ready for slaughter.

Last year, cattle and hogs backed up on U.S. farms and some animals were euthanized when meat plants shut due to COVID-19 outbreaks among workers.

A JBS beef plant in Grand Island, Nebraska, said only workers in maintenance and shipping were scheduled to work on Tuesday due to the cyberattack.

U.S. congressman Rick Crawford, an Arkansas Republican, called for a bipartisan effort to secure food and cyber security in the wake of the cyberattack.

“Cyber security is synonymous with national security, and so is food security,” Crawford wrote on Twitter.

(Reporting by Caroline Stauffer, Tom Polansek, Mark Weinraub in Chicago; Additional reporting by Jeff Mason aboard Air Force One and Trevor Hunnicutt in Washington, Ana Mano in Sao Paulo and Joe Menn in San Francisco; Editing by Chizu Nomiyama, Will Dunham and Nick Zieminski)

Meatpackers deny workers benefits for COVID-19 deaths, illnesses

By Tom Hals and Tom Polansek

(Reuters) – Saul Sanchez died in April, one of six workers with fatal COVID-19 infections at meatpacker JBS USA’s slaughterhouse in Greeley, Colorado, the site of one of the earliest and deadliest coronavirus outbreaks at a U.S. meatpacking plant.

Before getting sick, the 78-year-old Sanchez only left home to work on the fabrication line, where cattle carcasses are sliced into cuts of beef, and to go to his church, with its five-person congregation, said his daughter, Betty Rangel. She said no one else got infected in the family or at Bible Missionary Church, which could not be reached for comment.

JBS, the world’s largest meatpacker, denied the family’s application for workers’ compensation benefits, along with those filed by the families of two other Greeley workers who died of COVID-19, said lawyers handling the three claims. Families of the three other Greeley workers who died also sought compensation, a union representative said, but Reuters could not determine the status of their claims.

JBS has said the employees’ COVID-19 infections were not work-related in denying the claims, according to responses the company gave to employees, which were reviewed by Reuters.

As more Americans return to workplaces, the experience of JBS employees shows the difficulty of linking infections to employment and getting compensation for medical care and lost wages.

“That is the ultimate question: How can you prove it?” said Nick Fogel, an attorney specializing in workers’ compensation at the firm Burg Simpson in Colorado.

The meatpacking industry has suffered severe coronavirus outbreaks, in part because production-line workers often work side-by-side for long shifts. Companies including JBS, Tyson Foods Inc and WH Group Ltd’s Smithfield Foods closed about 20 plants this spring after outbreaks, prompting President Donald Trump in April to order the plants to stay open to ensure the nation’s meat supply. The White House declined to comment on the industry’s rejections of workers’ claims. The U.S. Department of Labor did not respond to a request for comment.

Tyson has also denied workers’ compensation claims stemming from a big outbreak in Iowa, workers’ attorneys told Reuters. Smithfield workers at a plant in Sioux Falls, South Dakota, also hit by a major outbreak, have generally not filed claims, a union official said, in part because the company has paid infected workers’ wages and medical bills.

Smithfield declined to comment on workers’ compensation. Tyson said it reviews claims on a case-by-case basis, but declined to disclose how often it rejects them. JBS acknowledged rejecting claims but declined to say how often. It called the denials consistent with the law, without elaborating.

Workers can challenge companies’ denials in an administrative process that varies by state but typically resembles a court hearing. The burden of proof, however, usually falls on the worker to prove a claim was wrongfully denied.

The full picture of how the meatpacking industry has handled COVID-related workers’ compensation remains murky because of a lack of national claims data. Reuters requested data from seven states where JBS or its affiliates have plants that had coronavirus outbreaks. Only three states provided data in any detail; all show a pattern of rejections.

In Minnesota, where JBS had a major outbreak, meatpacking employees filed 930 workers’ compensation claims involving COVID-19 as of Sept. 11, according to the Minnesota Department of Labor and Industry. None were accepted, 717 were rejected and 213 were under review. The agency did not identify the employers.

The Minnesota Department of Health said only two meatpacking plants there had significant coronavirus outbreaks: a JBS pork processing plant in Worthington, and a poultry plant in Cold Spring run by Pilgrim’s Pride Corp <PPC.O>, which is majority-owned by JBS.

Tom Atkinson, a Minnesota workers’ compensation attorney who has represented meatpacking workers, estimates up to 100 COVID-19 claims were filed by employees at the Worthington plant.

In Utah, seven JBS workers filed claims related to COVID-19 by Aug. 1 and all were denied, according to the state’s Labor Commission. At least 385 workers at a JBS beef plant in Hyrum, Utah, tested positive for COVID-19.

In Colorado, 69% of the 2,294 worker compensation claims for COVID-19 had been denied as of Sept. 12. Although the state does not break down the denials by industry, a JBS spokesman told Reuters the company is rejecting claims in Colorado and that it uses the same claim-review procedures nationwide.

JBS spokesman Cameron Bruett did not answer the question of whether JBS employees were infected on the job and declined comment on individual workers’ claims. He said the company has outsourced claim reviews to a third-party administrator.

“Given the widespread nature of viral spread, our third-party claims administrator reviews each case thoroughly and independently,” said Bruett.

The administrator, Sedgwick, did not respond to a request for comment. Bruett, also a spokesman for Pilgrim’s Pride, did not respond to questions about infections and claims at its Minnesota plant.

At the JBS plant in Greeley, where Sanchez worked before he died, at least 291 of about 6,000 workers were infected, according to state data. The company, in its written response to the family’s claim, said that his infection was “not work-related,” without spelling out its reasoning. The two sides are now litigating the matter in Colorado’s workers’ compensation system.

Under Colorado law, a workers’ compensation death benefit provides about two-thirds of the deceased worker’s salary to the surviving spouse and pays medical expenses not covered by insurance. If JBS had not denied the Sanchez family’s claim, that would have provided his widow a steady income and paid uncovered medical bills totaling about $10,000, according to his daughter.

“They don’t care,” Rangel said of JBS. “They are all about the big profits, and they are not going to give any money out.”

MASS INFECTIONS, LITTLE COMPENSATION

The United Food and Commercial Workers (UFCW) International Union, which represents 250,000 U.S. meatpacking and food-processing workers, said last week at least 122 meatpacking workers have died of COVID-19 and more than 18,000 had missed work because they were infected or potentially exposed.

The U.S. Occupational Safety and Health Administration (OSHA) said on Sept. 11 that it had cited JBS for failing to protect workers at the Greeley plant from the virus. OSHA cited Smithfield this month for failing to protect workers at its Sioux Falls, South Dakota, plant, where the agency said nearly 1,300 workers contracted the coronavirus and four died.

Smithfield and JBS said the citations had no merit because they concerned conditions in plants before OSHA issued COVID-19 guidance for the industry. OSHA said it stands by the citations.

Workers’ compensation is generally the only way to recoup medical expenses and lost wages for work-related injuries and deaths. The system protects employers from lawsuits, with few exceptions, and allows workers to collect benefits without having to prove fault or negligence. But the system was designed for factory accidents, not airborne illnesses.

In response to the coronavirus, governors and lawmakers in at least 14 states have made it easier for some employees to collect workers compensation for COVID-19 by putting the burden on companies and insurers to prove an infection did not occur at work. But most of the changes, which vary by state, only apply to workers in healthcare or emergency services. A similar proposal failed to gain support in Colorado.

Mark Dopp, general counsel for the North American Meat Institute, a trade association that represents meatpackers, said it is difficult to determine where workers get infections given extensive sanitation efforts taken by meat plants and workers’ daily travel to and from the plants.

Tyson in April closed its Waterloo, Iowa, pork processing plant due to a COVID-19 outbreak. Ben Roth, a local workers’ compensation attorney, said five families of employees who died filed workers compensation claims for death benefits, and all were denied.

He said meat-processing companies have an incentive to deny every claim because admitting they caused even one infection can expose the firms to liability for all workers contracting COVID-19.

“That undercuts the argument that they want to make across the board: that you can’t prove you got it here and not at a grocery store,” Roth said.

Tyson said it follows state laws for workers’ compensation. The company noted that Iowa law states that disease with an equal likelihood of being contracted outside the workplace are “not compensable as an occupational disease.”

In Colorado, Sylvia Martinez runs a group called Latinos Unidos of Greeley and said she knows of more than 20 JBS workers who applied for workers compensation and were denied. Many plant workers are not native English speakers and sought out her group for guidance, she said, adding that many don’t understand their rights and fear being fired. The company’s rejections have discouraged more claims, Martinez said.

“If you deny five or 10, those workers will tell their co-workers,” she said.

‘WHO IS GOING TO HIRE HIM?’

JBS also contested the claim of Alfredo Hernandez, 55, a custodian who worked at the Greeley plant for 31 years. He became infected and was hospitalized in March. He still relies on supplemental oxygen and hasn’t returned to work, said his wife, Rosario Hernandez.

Generall y, companies approve claims if it looks probable that an employee was injured or sickened at work, said Erika Alverson, the attorney representing Hernandez. But JBS, she said, is arguing workers could have contracted COVID-19 anywhere.

“They’re getting into, where did our clients go, what were they doing during that time, who was coming into their house, what did their spouse do, was there any other form of exposure?” said Alverson, of the Denver firm Alverson and O’Brien.

A judge will decide the Hernandez case in an administrative hearing. In the meantime, the Hernandez family has only his disability benefits – a portion of his salary – to cover his medical and insurance costs, Rosario Hernandez said.

“We’re getting bunches of bills,” she said.

(Reporting by Tom Hals in Wilmington, Delaware, and Tom Polansek in Chicago; Editing by Noeleen Walder, Caroline Stauffer and Brian Thevenot)