Loading story…
The Coca-Cola Company disclosed in an SEC filing that a ransomware attack hit systems at its wholly owned dairy subsidiary Fairlife, giving attackers unauthorized access to part of the company’s environment, including production-related systems. The incident forced Fairlife to temporarily suspend production of its products across U.S. facilities, while the company said Canadian operations were not affected and that product quality and safety were not impacted.
Coca-Cola said it activated incident response and business continuity procedures, engaged outside advisors and cybersecurity experts, and notified law enforcement as it investigates the full scope and business impact of the breach. The company has not said whether data was stolen, whether an extortion demand was made, or when U.S. production will resume, and no ransomware group had publicly claimed responsibility at the time of reporting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The Anubis ransomware gang publicly claimed responsibility for the Fairlife attack and threatened to publish allegedly stolen data unless the company negotiates. The group also alleged it encrypted Fairlife's Nutanix infrastructure and stole about 1 TB of corporate data, though those claims were not independently verified.
A new report attributed the ransomware attack affecting Fairlife/Coca-Cola to the Anubis threat group and characterized the incident as a ransomware-linked data breach. This adds threat actor attribution not present in the existing timeline.
In a July 16 SEC filing, Coca-Cola publicly disclosed the ransomware attack affecting its Fairlife subsidiary and said it had activated incident response and business continuity protocols. The company also said law enforcement had been notified and outside advisors were assisting the investigation.
Following the ransomware incident, Fairlife temporarily suspended production operations at its U.S. facilities. Coca-Cola said Canadian production was unaffected and product quality and safety were not impacted.
Coca-Cola disclosed that a ransomware attack resulted in unauthorized access to a portion of Fairlife's systems, including production-related systems. The company said the full scope and impact were still under investigation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
21 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcesecurityweek.com
Open sourceteiss.co.uk
Open sourcethecyberthrone.in
Open sourcesec.gov
Open sourcesec.gov
Open sourcetechcrunch.com
Open sourceinvestors.coca-colacompany.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dairy Farmers of America, a major Kansas-based farmer-owned dairy cooperative, suffered a significant ransomware attack in June, which was later claimed by the Play ransomware group. The attack resulted in unauthorized access to the cooperative's systems, leading to the theft of sensitive personal information belonging to 4,546 individuals. The compromised data included names, dates of birth, Social Security numbers, bank account details, driver's license or state-issued ID numbers, and Medicare or Medicaid numbers. The breach affected both employees and members of the cooperative, which is responsible for marketing and selling milk and related products from its 9,500 farmer-owners and employs approximately 19,000 people. The organization reported $24.5 billion in revenue in 2022 and is responsible for producing about 23% of all U.S. milk, highlighting the potential impact of the attack on the broader food and agriculture sector. The attackers gained access to the network through a sophisticated social engineering campaign, which enabled them to bypass security controls and begin exfiltrating data shortly after the initial compromise. Dairy Farmers of America discovered the breach two days after the attack began and subsequently launched an internal investigation, which concluded on September 15. The organization filed breach notifications with regulators in Maine and began notifying affected individuals, offering two years of identity protection services to those impacted. The Play ransomware group, which has been active since 2022, has been linked to over 900 attacks globally, including dozens of high-profile incidents targeting various sectors. The incident at Dairy Farmers of America is part of a broader trend, with the food and agriculture sector experiencing 84 ransomware attacks in the first quarter of 2025 alone, more than double the number from the same period the previous year. Despite the growing threat, recent bipartisan Senate legislation aimed at improving cyber defenses for the food and agriculture industry has not been enacted. The breach underscores the increasing use of advanced social engineering tactics by ransomware groups to target critical infrastructure and highlights the ongoing vulnerability of the food supply chain to cyber threats. Dairy Farmers of America did not respond to media requests for further comment regarding the incident. The attack has raised concerns about the resilience of essential services and the need for enhanced cybersecurity measures across the agricultural sector. Regulatory scrutiny is expected to increase as a result of the breach, with potential implications for industry-wide security standards. The incident serves as a stark reminder of the risks posed by ransomware to organizations managing sensitive personal and financial data.
Jun 29, 2026
West Pharmaceutical Services disclosed that attackers breached its network, stole data, and encrypted parts of its environment in a ransomware attack that disrupted global business operations. The Pennsylvania-based manufacturer said it detected the incident on May 4 and responded by shutting down and isolating affected on-premise infrastructure, restricting access to enterprise systems, notifying law enforcement, and bringing in Palo Alto Networks' Unit 42 to support containment, forensics, and recovery. The company said the attack affected critical systems used for shipping, receiving, and manufacturing products, though core enterprise systems have since been restored and some sites have resumed critical processes and partial manufacturing operations. West is still investigating what data was exfiltrated and whether the incident will have a material financial impact, and no ransomware group had publicly claimed responsibility at the time of reporting.
Jun 29, 2026
**Ransomware and data-extortion activity** was reported across multiple sectors, with threat actors using leak sites to pressure victims and amplify impact. The **RansomHub** ransomware-as-a-service operation claimed it breached Chinese manufacturer **Luxshare** and stole sensitive manufacturing and R&D archives allegedly tied to major technology firms (including Apple, Nvidia, Tesla, and LG). The posted sample was described as containing engineering artifacts such as **3D CAD/Parasolid files, PCB manufacturing data, and engineering documentation**, plus some project-related PII; the breach had not been independently confirmed at the time of reporting. Separately, the **Everest** ransomware group claimed it breached **McDonald’s India**, alleging exfiltration of **861 GB** of internal documents and customer personal data and threatening publication if demands were not met; McDonald’s India had not confirmed the claim. In US healthcare, **Valley Eye Associates** confirmed a ransomware incident with **data exfiltration** during a short intrusion window, while **Qilin** publicly claimed responsibility and alleged **139 GB** stolen and posted—suggesting a non-payment outcome. A related but distinct development involved healthcare IT vendor **Veradigm**, which agreed to a **$10.5M** settlement tied to a prior (2024) breach affecting **2+ million** patients, underscoring ongoing legal and financial exposure following large-scale patient-data compromises.
Jun 29, 2026