Loading story…
Coca-Cola confirmed that a ransomware attack on its dairy subsidiary Fairlife led to a data breach and temporary production disruption at four U.S. facilities. The company had disclosed the cybersecurity incident in a July 16 SEC filing after suspending some operations, and later said most production had resumed while restoration work continued. Coca-Cola reported the intrusion to authorities and said retail availability, product quality, and safety were largely unaffected, with no expected material impact on its financial condition or operating results.
The Anubis ransomware group claimed responsibility, alleging it stole 1 TB of confidential data and encrypted Fairlife systems, including claimed access to Nutanix infrastructure. After listing Coca-Cola and Fairlife on its leak site, the gang reportedly released the stolen files when its countdown expired. Anubis, a double-extortion operation active since late 2024, is also known for a wiper-mode capability that can permanently delete victim files; Coca-Cola said it did not negotiate with the attackers.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Coca-Cola confirmed that the ransomware attack on Fairlife resulted in data theft, said it had reported the intrusion to authorities, and stated it did not negotiate with the attackers.
Coca-Cola later stated that most production at Fairlife's four U.S. facilities had resumed, though some systems and operations were still being restored.
The references describe Anubis as a double-extortion ransomware group that has been active since December 2024 and note it is known for a wiper-mode capability that can permanently delete victims' files.
After the Anubis leak-site timer expired, the data the gang claimed to have stolen from Fairlife was made available for download.
On July 20, 2026, the Anubis ransomware group claimed responsibility for the attack by posting Coca-Cola and Fairlife on its leak site and alleging it had stolen 1 TB of confidential data in addition to encrypting systems.
On July 16, 2026, Coca-Cola disclosed in an SEC filing that a cybersecurity intrusion affecting its Fairlife dairy subsidiary had led to suspended production at Fairlife facilities in the United States while the company responded to the incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcetechrepublic.com
Open sourcexakep.ru
Open sourcehelpnetsecurity.com
Open sourcehookphish.com
Open sourcesecurityweek.com
Open sourceinvestors.coca-colacompany.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Coca-Cola disclosed that its dairy subsidiary **Fairlife** suffered a ransomware-related cyber incident that led to data theft and temporary production outages across its four U.S. facilities. Fairlife identified unauthorized third-party access on **July 16** and, according to a U.S. SEC filing, activated incident response and business continuity measures while Coca-Cola brought in external cybersecurity specialists. The intrusion affected parts of Fairlife’s network, including production-related systems, forcing a temporary shutdown of U.S. production operations. The **Anubis** ransomware group claimed responsibility, with reports attributing to it the theft of between **671GB** and **1TB** of data, including HR records, engineering and technical documentation, and production data, though Coca-Cola did not confirm the attackers’ figures. Most production was later restored, retail availability was largely maintained through existing inventory, and Fairlife said product quality and safety were not affected. Coca-Cola also said it did not expect the incident to have a material financial impact, while the breach underscored how ransomware is increasingly disrupting operational technology and physical manufacturing processes as well as stealing data.
Aug 11, 2026
The Anubis ransomware group claimed it compromised dairy producer **Fairlife**, affecting **500 hosts** and stealing about **1 TB** of data, according to reporting that also highlighted differences between the gang’s account and statements attributed to parent company **Coca-Cola**. Anubis said the intrusion was **opportunistic rather than targeted**, describing its method as opening “all doors with weak locks” before determining what it had accessed. Anubis further claimed there was **no real negotiation** after the intrusion, saying it waited just over a week, attempted to contact the victim by telephone, and then deleted the decryption keys before starting to publish stolen data when no response arrived. The reporting underscores how quickly ransomware operators now move from intrusion to extortion and public leaks, compressing the timeline for incident response, executive decision-making, and disclosure.
Aug 16, 2026
The Coca-Cola Company disclosed in an SEC filing that a ransomware attack hit systems at its wholly owned dairy subsidiary **Fairlife**, giving attackers unauthorized access to part of the company’s environment, including **production-related systems**. The incident forced Fairlife to temporarily suspend production of its products across U.S. facilities, while the company said **Canadian operations were not affected** and that **product quality and safety were not impacted**. Coca-Cola said it activated incident response and business continuity procedures, engaged outside advisors and cybersecurity experts, and notified law enforcement as it investigates the full scope and business impact of the breach. The company has not said whether data was stolen, whether an extortion demand was made, or when U.S. production will resume, and no ransomware group had publicly claimed responsibility at the time of reporting.
Jul 23, 2026