Loading story…
The Coca-Cola Company disclosed in an SEC filing that a ransomware attack hit systems at its wholly owned dairy subsidiary Fairlife, giving attackers unauthorized access to part of the company’s environment, including production-related systems. The incident forced Fairlife to temporarily suspend production of its products across U.S. facilities, while the company said Canadian operations were not affected and that product quality and safety were not impacted.
Coca-Cola said it activated incident response and business continuity procedures, engaged outside advisors and cybersecurity experts, and notified law enforcement as it investigates the full scope and business impact of the breach. The company has not said whether data was stolen, whether an extortion demand was made, or when U.S. production will resume, and no ransomware group had publicly claimed responsibility at the time of reporting.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
The Anubis ransomware gang publicly claimed responsibility for the Fairlife attack and threatened to publish allegedly stolen data unless the company negotiates. The group also alleged it encrypted Fairlife's Nutanix infrastructure and stole about 1 TB of corporate data, though those claims were not independently verified.
A new report attributed the ransomware attack affecting Fairlife/Coca-Cola to the Anubis threat group and characterized the incident as a ransomware-linked data breach. This adds threat actor attribution not present in the existing timeline.
In a July 16 SEC filing, Coca-Cola publicly disclosed the ransomware attack affecting its Fairlife subsidiary and said it had activated incident response and business continuity protocols. The company also said law enforcement had been notified and outside advisors were assisting the investigation.
Following the ransomware incident, Fairlife temporarily suspended production operations at its U.S. facilities. Coca-Cola said Canadian production was unaffected and product quality and safety were not impacted.
Coca-Cola disclosed that a ransomware attack resulted in unauthorized access to a portion of Fairlife's systems, including production-related systems. The company said the full scope and impact were still under investigation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
21 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcesecurityweek.com
Open sourcethecyberthrone.in
Open sourceteiss.co.uk
Open sourcesec.gov
Open sourcebleepingcomputer.com
Open sourceinvestors.coca-colacompany.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Coca-Cola disclosed that its dairy subsidiary **Fairlife** suffered a ransomware-related cyber incident that led to data theft and temporary production outages across its four U.S. facilities. Fairlife identified unauthorized third-party access on **July 16** and, according to a U.S. SEC filing, activated incident response and business continuity measures while Coca-Cola brought in external cybersecurity specialists. The intrusion affected parts of Fairlife’s network, including production-related systems, forcing a temporary shutdown of U.S. production operations. The **Anubis** ransomware group claimed responsibility, with reports attributing to it the theft of between **671GB** and **1TB** of data, including HR records, engineering and technical documentation, and production data, though Coca-Cola did not confirm the attackers’ figures. Most production was later restored, retail availability was largely maintained through existing inventory, and Fairlife said product quality and safety were not affected. Coca-Cola also said it did not expect the incident to have a material financial impact, while the breach underscored how ransomware is increasingly disrupting operational technology and physical manufacturing processes as well as stealing data.
Aug 11, 2026
Coca-Cola confirmed that a ransomware attack on its dairy subsidiary **Fairlife** led to a data breach and temporary production disruption at four U.S. facilities. The company had disclosed the cybersecurity incident in a July 16 SEC filing after suspending some operations, and later said most production had resumed while restoration work continued. Coca-Cola reported the intrusion to authorities and said retail availability, product quality, and safety were largely unaffected, with no expected material impact on its financial condition or operating results. The **Anubis** ransomware group claimed responsibility, alleging it stole **1 TB** of confidential data and encrypted Fairlife systems, including claimed access to **Nutanix** infrastructure. After listing Coca-Cola and Fairlife on its leak site, the gang reportedly released the stolen files when its countdown expired. Anubis, a double-extortion operation active since late 2024, is also known for a wiper-mode capability that can permanently delete victim files; Coca-Cola said it did not negotiate with the attackers.
Jul 29, 2026
The Anubis ransomware group claimed it compromised dairy producer **Fairlife**, affecting **500 hosts** and stealing about **1 TB** of data, according to reporting that also highlighted differences between the gang’s account and statements attributed to parent company **Coca-Cola**. Anubis said the intrusion was **opportunistic rather than targeted**, describing its method as opening “all doors with weak locks” before determining what it had accessed. Anubis further claimed there was **no real negotiation** after the intrusion, saying it waited just over a week, attempted to contact the victim by telephone, and then deleted the decryption keys before starting to publish stolen data when no response arrived. The reporting underscores how quickly ransomware operators now move from intrusion to extortion and public leaks, compressing the timeline for incident response, executive decision-making, and disclosure.
Aug 16, 2026