[REVISION HISTORY]

Coca-Cola Fairlife ransomware attack, US production resumes

Updated 4 times since CLSTR started tracking revisions of this situation.

What changed

2026-07-29 04:13 UTC → 2026-07-30 05:56 UTC · added ~~removed~~

Coca‑Cola disclosed on 16 July 2026 that the Anubis ransomware gang accessed part of Fairlife’s systems and exfiltrated roughly one terabyte of data, prompting a suspension of dairy manufacturing at its U.S. plants in Michigan, Arizona and New York. Production halted for nearly two weeks while Canadian facilities continued operating. By late July most production lines at the four U.S. sites were back online, and on 27 July the company ~~reported~~ announced that the majority of production had resumed, describing “significant progress” in restoring services. Existing inventory kept retail shelves stocked, and Coca‑Cola affirmed that product quality and safety were unaffected. The incident is not expected to have a material financial impact. Coca‑Cola engaged external cybersecurity advisers, filed a Form 8‑K, notified law enforcement and continues to monitor and secure its systems. ~~Fairlife,~~ fairlife, acquired ~~by Coca‑Cola~~ in 2020 for about $7 billion and generating over $3 billion in annual sales, remains operational. The July 30 update reiterated that most U.S. facilities are running and highlighted the broader cyber‑risk facing food‑and‑beverage manufacturers as IT and operational‑technology environments converge. Leadership transitions within North America continue, with President and CFO John Murphy assuming interim responsibilities for the unit.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.