{"id":"fairlife-ransomware-production-halt-jul-2026","category":"breach","status":"closed","title":"Fairlife ransomware halts US dairy production and steals data; nearly all production restored","tldr":"Ransomware stopped Fairlife’s US dairy production and stole company data. Nearly all production was back by 28 July. Coca-Cola said product safety was unaffected. Families have no update to install or product-safety action to take over this incident.","summary":"Coca-Cola disclosed on 16 July that ransomware attackers had accessed Fairlife systems, including systems supporting production, prompting a suspension of US dairy production. Canadian production was unaffected. The company brought in outside specialists and notified law enforcement. On 27 July, Coca-Cola confirmed data theft and said most production had resumed at its four US facilities, although restoration work continued. Existing inventory had largely protected shop availability, and the company said product quality and safety were unaffected. Its chief executive said on 28 July that nearly all previous production was back online. BleepingComputer reported that Anubis claimed the attack and published alleged stolen files; Coca-Cola did not confirm the group's claimed one-terabyte haul. As of 3 November, no newer incident update was found in the search. The reviewed sources do not establish what personal information, if any, was exposed, whether affected individuals were notified, whether a ransom was paid, or whether every affected system was restored.","action":"Nothing for you to do: this affected Fairlife’s business systems, and Coca-Cola said product quality and safety were unaffected. There is no software update for families to install.","product":"Fairlife US dairy production and company systems","audience":"work","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["fairlife","coca-cola","ransomware","data-theft","manufacturing"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Form 8-K: Fairlife ransomware incident","url":"https://www.sec.gov/Archives/edgar/data/21344/000162828026048466/ko-20260716.htm","by":"The Coca-Cola Company","date":"2026-07-16"},{"kind":"advisory","title":"The Coca-Cola Company Announces Significant Progress in Restoring fairlife Operations Following Technology Disruption","url":"https://investors.coca-colacompany.com/news-events/press-releases/detail/1167/the-coca-cola-company-announces-significant-progress-in-restoring-fairlife-operations-following-technology-disruption","by":"The Coca-Cola Company","date":"2026-07-27"},{"kind":"news","title":"Coca-Cola confirms data theft in Fairlife ransomware attack","url":"https://www.bleepingcomputer.com/news/security/coca-cola-confirms-data-theft-in-fairlife-ransomware-attack/","by":"BleepingComputer","date":"2026-07-27"},{"kind":"news","title":"Coca-Cola resumes ‘majority’ of Fairlife U.S. production after cyberattack","url":"https://www.ajc.com/business/2026/07/coca-cola-resumes-majority-of-fairlife-us-production-after-cyberattack/","by":"The Atlanta Journal-Constitution","date":"2026-07-28"}],"started":"2026-07-16","closed":"2026-07-28","created":"2026-11-03T20:59:52.508Z","updated":"2026-11-03T20:59:52.508Z","cve_notes":[],"timeline":[{"at":"2026-07-28","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Coca-Cola chief executive Henrique Braun told The Atlanta Journal-Constitution that nearly all pre-incident production was back online. This provided a further recovery update without confirming that every affected system had been restored.","url":"https://www.ajc.com/business/2026/07/coca-cola-resumes-majority-of-fairlife-us-production-after-cyberattack/","by":"The Atlanta Journal-Constitution","patch":null},{"at":"2026-07-27","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"BleepingComputer reported that Anubis had claimed responsibility, demanded a ransom and published files it attributed to Fairlife. The group's claim to have stolen one terabyte was not confirmed by Coca-Cola.","url":"https://www.bleepingcomputer.com/news/security/coca-cola-confirms-data-theft-in-fairlife-ransomware-attack/","by":"BleepingComputer","patch":null},{"at":"2026-07-27","added":"2026-11-03T20:51:54.186Z","kind":"vendor-revised","text":"Coca-Cola confirmed that data had been stolen and that most production had resumed across Fairlife’s four US facilities. Some restoration continued, while existing inventory had largely protected retail availability.","url":"https://investors.coca-colacompany.com/news-events/press-releases/detail/1167/the-coca-cola-company-announces-significant-progress-in-restoring-fairlife-operations-following-technology-disruption","by":"The Coca-Cola Company","patch":null},{"at":"2026-07-16","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"Coca-Cola disclosed ransomware involving unauthorised access to Fairlife systems, including production-related systems. US production was suspended; Canadian production and product safety were unaffected, and law enforcement had been notified.","url":"https://www.sec.gov/Archives/edgar/data/21344/000162828026048466/ko-20260716.htm","by":"The Coca-Cola Company","patch":"na"}],"url":"https://hard.fyi/live/fairlife-ransomware-production-halt-jul-2026/","json":"https://hard.fyi/api/live?id=fairlife-ransomware-production-halt-jul-2026"}