Ransomware Attack Shuts Down Fairlife Dairy Production Across the US

Quick Facts

• Coca-Cola filed an SEC Form 8-K on July 16, 2026, disclosing a ransomware attack on its Fairlife dairy subsidiary that suspended all US production operations.
• Fairlife posted $4 billion in sales in 2024 and represents Coca-Cola’s largest brand acquisition in the company’s 133-year history, at a total cost projected to reach $7.18 billion.
• No ransomware group has claimed responsibility, and Coca-Cola has not confirmed whether data was stolen or an extortion demand was received.

Coca-Cola disclosed on July 16 that its Fairlife dairy subsidiary suffered a ransomware attack that forced a suspension of all US production operations. The company filed a Form 8-K with the SEC, stating that Fairlife detected unauthorized access to a portion of its systems, including production-related systems.

Canadian operations are not currently affected. Product quality and safety have not been compromised, the company said.

Coca-Cola activated its incident response and business continuity protocols after detecting the breach. Outside cybersecurity advisors are assisting with the investigation, and law enforcement has been notified. The company said it is working to restore systems and impacted operations.

The full scope of the attack remains unknown. Coca-Cola has not disclosed whether the attackers stole data, whether an extortion demand has been issued, or which ransomware group is responsible. When contacted by BleepingComputer, a company spokesperson said there was nothing additional to share beyond the public statement.

The financial stakes are high. Fairlife generated $4 billion in sales in 2024. Coca-Cola’s total payment for the Fairlife acquisition is projected to reach $7.18 billion, making it the largest brand purchase in the company’s history. CEO James Quincey has called Fairlife central to the company’s strategy to expand beyond carbonated beverages.

Fairlife products, including ultra-filtered milk, Core Power protein shakes, and nutrition drinks, have surged in popularity tied to health and wellness trends. The brand offers 13 grams of protein per cup, compared to 8 grams in regular milk, a selling point amplified by the rise of GLP-1 weight-loss drugs that encourage higher protein intake.

An extended production shutdown could reduce product availability on grocery shelves across the United States. Coca-Cola has not said how long operations will remain suspended.

The attack fits a broader pattern hitting the food and beverage sector. Industrial cybersecurity firm Dragos ranks food and beverage as the second most-targeted manufacturing subsector, accounting for 75 incidents and 16% of all manufacturing ransomware in the first quarter of 2025 alone. Across all sectors, 6,377 ransomware incidents were tracked in 2025, an 82% increase over 2024.

Past attacks on food companies demonstrate the potential damage. Marks and Spencer disclosed that a ransomware attack over Easter 2025 caused 324 million pounds in lost sales and cut pre-tax profits by 55.4%. Arizona Beverages and food distributor UNFI both endured weeks-long production disruptions following similar incidents.

For technology and software executives, the Fairlife attack is a reminder that ransomware targeting operational technology and production systems carries consequences beyond data loss. When manufacturing systems go offline, revenue stops immediately and supply chains feel the impact within days.

Coca-Cola said it has not yet determined whether the incident will have a material effect on the company’s financial results. The investigation is ongoing.

Read more: Coca-Cola suspended production at its Fairlife dairy after a ransomware attack