Loading story…
The Anubis ransomware group claimed it compromised dairy producer Fairlife, affecting 500 hosts and stealing about 1 TB of data, according to reporting that also highlighted differences between the gang’s account and statements attributed to parent company Coca-Cola. Anubis said the intrusion was opportunistic rather than targeted, describing its method as opening “all doors with weak locks” before determining what it had accessed.
Anubis further claimed there was no real negotiation after the intrusion, saying it waited just over a week, attempted to contact the victim by telephone, and then deleted the decryption keys before starting to publish stolen data when no response arrived. The reporting underscores how quickly ransomware operators now move from intrusion to extortion and public leaks, compressing the timeline for incident response, executive decision-making, and disclosure.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Marco De Felice's reporting, cited by both references, presented Anubis's claims about the Fairlife incident alongside Coca-Cola's statements and noted discrepancies between the two accounts.
Anubis claimed that after receiving no response to its demands, it deleted the decryption keys and started publishing stolen data from Fairlife.
According to Anubis, there was never a real negotiation with Fairlife, and the group attempted to establish contact by telephone after waiting just over a week.
Anubis said the Fairlife incident was not a targeted attack and described its method as opportunistically exploiting weakly secured environments before determining what it had accessed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Coca-Cola confirmed that a ransomware attack on its dairy subsidiary **Fairlife** led to a data breach and temporary production disruption at four U.S. facilities. The company had disclosed the cybersecurity incident in a July 16 SEC filing after suspending some operations, and later said most production had resumed while restoration work continued. Coca-Cola reported the intrusion to authorities and said retail availability, product quality, and safety were largely unaffected, with no expected material impact on its financial condition or operating results. The **Anubis** ransomware group claimed responsibility, alleging it stole **1 TB** of confidential data and encrypted Fairlife systems, including claimed access to **Nutanix** infrastructure. After listing Coca-Cola and Fairlife on its leak site, the gang reportedly released the stolen files when its countdown expired. Anubis, a double-extortion operation active since late 2024, is also known for a wiper-mode capability that can permanently delete victim files; Coca-Cola said it did not negotiate with the attackers.
Jul 29, 2026
Coca-Cola disclosed that its dairy subsidiary **Fairlife** suffered a ransomware-related cyber incident that led to data theft and temporary production outages across its four U.S. facilities. Fairlife identified unauthorized third-party access on **July 16** and, according to a U.S. SEC filing, activated incident response and business continuity measures while Coca-Cola brought in external cybersecurity specialists. The intrusion affected parts of Fairlife’s network, including production-related systems, forcing a temporary shutdown of U.S. production operations. The **Anubis** ransomware group claimed responsibility, with reports attributing to it the theft of between **671GB** and **1TB** of data, including HR records, engineering and technical documentation, and production data, though Coca-Cola did not confirm the attackers’ figures. Most production was later restored, retail availability was largely maintained through existing inventory, and Fairlife said product quality and safety were not affected. Coca-Cola also said it did not expect the incident to have a material financial impact, while the breach underscored how ransomware is increasingly disrupting operational technology and physical manufacturing processes as well as stealing data.
Aug 11, 2026
The Coca-Cola Company disclosed in an SEC filing that a ransomware attack hit systems at its wholly owned dairy subsidiary **Fairlife**, giving attackers unauthorized access to part of the company’s environment, including **production-related systems**. The incident forced Fairlife to temporarily suspend production of its products across U.S. facilities, while the company said **Canadian operations were not affected** and that **product quality and safety were not impacted**. Coca-Cola said it activated incident response and business continuity procedures, engaged outside advisors and cybersecurity experts, and notified law enforcement as it investigates the full scope and business impact of the breach. The company has not said whether data was stolen, whether an extortion demand was made, or when U.S. production will resume, and no ransomware group had publicly claimed responsibility at the time of reporting.
Jul 23, 2026