Loading story…
Coca-Cola disclosed that its dairy subsidiary Fairlife suffered a ransomware-related cyber incident that led to data theft and temporary production outages across its four U.S. facilities. Fairlife identified unauthorized third-party access on July 16 and, according to a U.S. SEC filing, activated incident response and business continuity measures while Coca-Cola brought in external cybersecurity specialists. The intrusion affected parts of Fairlife’s network, including production-related systems, forcing a temporary shutdown of U.S. production operations.
The Anubis ransomware group claimed responsibility, with reports attributing to it the theft of between 671GB and 1TB of data, including HR records, engineering and technical documentation, and production data, though Coca-Cola did not confirm the attackers’ figures. Most production was later restored, retail availability was largely maintained through existing inventory, and Fairlife said product quality and safety were not affected. Coca-Cola also said it did not expect the incident to have a material financial impact, while the breach underscored how ransomware is increasingly disrupting operational technology and physical manufacturing processes as well as stealing data.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Coca-Cola said that by July 27, Fairlife had resumed the majority of production at its four U.S. facilities. The company also said retail availability was largely unaffected and product quality and safety were not impacted.
Fairlife identified unauthorized third-party access to part of its systems on July 16. Coca-Cola said the company activated incident response and business continuity measures, engaged external experts, and temporarily shut down U.S. production at Fairlife facilities.
Coca-Cola disclosed the Fairlife ransomware-related incident in a U.S. SEC Form 8-K, stating that the breach involved unauthorized access, data theft, and temporary production outages. The filing said the company did not expect the incident to have a material financial impact.
Screenshots posted to X indicated that the Anubis ransomware group claimed responsibility for the Fairlife incident. Anubis alleged it stole Fairlife data and threatened or claimed to publish it, though Coca-Cola did not confirm the group's data-theft claims.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Coca-Cola confirmed that a ransomware attack on its dairy subsidiary **Fairlife** led to a data breach and temporary production disruption at four U.S. facilities. The company had disclosed the cybersecurity incident in a July 16 SEC filing after suspending some operations, and later said most production had resumed while restoration work continued. Coca-Cola reported the intrusion to authorities and said retail availability, product quality, and safety were largely unaffected, with no expected material impact on its financial condition or operating results. The **Anubis** ransomware group claimed responsibility, alleging it stole **1 TB** of confidential data and encrypted Fairlife systems, including claimed access to **Nutanix** infrastructure. After listing Coca-Cola and Fairlife on its leak site, the gang reportedly released the stolen files when its countdown expired. Anubis, a double-extortion operation active since late 2024, is also known for a wiper-mode capability that can permanently delete victim files; Coca-Cola said it did not negotiate with the attackers.
Jul 29, 2026
The Coca-Cola Company disclosed in an SEC filing that a ransomware attack hit systems at its wholly owned dairy subsidiary **Fairlife**, giving attackers unauthorized access to part of the company’s environment, including **production-related systems**. The incident forced Fairlife to temporarily suspend production of its products across U.S. facilities, while the company said **Canadian operations were not affected** and that **product quality and safety were not impacted**. Coca-Cola said it activated incident response and business continuity procedures, engaged outside advisors and cybersecurity experts, and notified law enforcement as it investigates the full scope and business impact of the breach. The company has not said whether data was stolen, whether an extortion demand was made, or when U.S. production will resume, and no ransomware group had publicly claimed responsibility at the time of reporting.
Jul 23, 2026
The Anubis ransomware group claimed it compromised dairy producer **Fairlife**, affecting **500 hosts** and stealing about **1 TB** of data, according to reporting that also highlighted differences between the gang’s account and statements attributed to parent company **Coca-Cola**. Anubis said the intrusion was **opportunistic rather than targeted**, describing its method as opening “all doors with weak locks” before determining what it had accessed. Anubis further claimed there was **no real negotiation** after the intrusion, saying it waited just over a week, attempted to contact the victim by telephone, and then deleted the decryption keys before starting to publish stolen data when no response arrived. The reporting underscores how quickly ransomware operators now move from intrusion to extortion and public leaks, compressing the timeline for incident response, executive decision-making, and disclosure.
Aug 16, 2026