Fairlife ransomware halts US dairy production and steals data; nearly all production restored
Ransomware stopped Fairlife’s US dairy production and stole company data. Nearly all production was back by 28 July. Coca-Cola said product safety was unaffected. Families have no update to install or product-safety action to take over this incident.
Nothing for you to do: this affected Fairlife’s business systems, and Coca-Cola said product quality and safety were unaffected. There is no software update for families to install.
What’s happening
Coca-Cola disclosed on 16 July that ransomware attackers had accessed Fairlife systems, including systems supporting production, prompting a suspension of US dairy production. Canadian production was unaffected. The company brought in outside specialists and notified law enforcement. On 27 July, Coca-Cola confirmed data theft and said most production had resumed at its four US facilities, although restoration work continued. Existing inventory had largely protected shop availability, and the company said product quality and safety were unaffected. Its chief executive said on 28 July that nearly all previous production was back online. BleepingComputer reported that Anubis claimed the attack and published alleged stolen files; Coca-Cola did not confirm the group's claimed one-terabyte haul. As of 3 November, no newer incident update was found in the search. The reviewed sources do not establish what personal information, if any, was exposed, whether affected individuals were notified, whether a ransom was paid, or whether every affected system was restored.
- What
- Breach
- Affects
- Fairlife US dairy production and company systems
- Fixed in
- Nothing to patch
- Since
- 16 July 2026
- Closed
- 28 July 2026
Timeline
- Update
Coca-Cola chief executive Henrique Braun told The Atlanta Journal-Constitution that nearly all pre-incident production was back online. This provided a further recovery update without confirming that every affected system had been restored.
- Update
BleepingComputer reported that Anubis had claimed responsibility, demanded a ransom and published files it attributed to Fairlife. The group's claim to have stolen one terabyte was not confirmed by Coca-Cola.
- Vendor revised
Coca-Cola confirmed that data had been stolen and that most production had resumed across Fairlife’s four US facilities. Some restoration continued, while existing inventory had largely protected retail availability.
- Made publicNothing to patch
Coca-Cola disclosed ransomware involving unauthorised access to Fairlife systems, including production-related systems. US production was suspended; Canadian production and product safety were unaffected, and law enforcement had been notified.
Sources
- Form 8-K: Fairlife ransomware incidentThe Coca-Cola Company · 16 July 2026
- The Coca-Cola Company Announces Significant Progress in Restoring fairlife Operations Following Technology DisruptionThe Coca-Cola Company · 27 July 2026
- Coca-Cola confirms data theft in Fairlife ransomware attackBleepingComputer · 27 July 2026
- Coca-Cola resumes ‘majority’ of Fairlife U.S. production after cyberattackThe Atlanta Journal-Constitution · 28 July 2026