Food distribution giant Sysco confirms data breach impacting customer and employee data

Global food distribution company Sysco has disclosed a data breach that allegedly exposed the personal information of customers, suppliers and US employees.

According to an internal memo sent to employees earlier this month, and seen by BleepingComputer, the company suffered a cyberattack that led to unauthorized access to its data.

"On March 5, 2023, Sysco became aware of a cybersecurity event perpetrated by a threat actor believed to have begun on January 14, 2023, in which the threat actor gained access to our systems without authorization and claimed to have acquired certain data," the notice explains.

The employee data accessed allegedly includes names, Social Security Numbers, account numbers, and other personal information provided to Sysco for payroll purposes.

Sysco said the attack didn’t affect day-to-day operations or customer service. The breach was publicly disclosed in a quarterly report filed with the US Securities and Exchange Commission on May 2.

"The investigation determined that the threat actor extracted certain company data, including data relating to operation of the business, customers, employees and personal data," the company said.

"The investigation is ongoing, and Sysco has begun the process of preparing to comply with its obligations with respect to the extracted data."

Although the number of impacted individuals has not been revealed, most of the company’s 71,000 employees were potentially affected by the security incident.

Until particulars of the data breach are vailable, we would recommend any Sysco employee or customer closely monitor accounts for any unusual activity. Victims should also adhere to good cyber hygiene and be wary of unsolicited messages requesting sensitive information, credentials, PINs or other data.

Need help monitoring your personal and financial info to defend against identity theft and fraud? Check out our dedicated identity theft protection solutions here.