Coca-Cola halts US fairlife dairy production after ransomware attack

On 16 July 2026, The Coca-Cola Company — the Atlanta beverage giant that owns the Chicago-based ultra-filtered milk brand fairlife — disclosed in a Form 8-K filed with the U.S. Securities and Exchange Commission that its fairlife subsidiary had been hit by a ransomware attack. According to the filing, fairlife "identified unauthorized access by a third party to a portion of its systems, including its production-related systems, in connection with a ransomware event." The disruption was severe enough that production operations at fairlife in the United States were temporarily suspended.

The company said it promptly activated its incident response and business continuity protocols after detecting the issue and that its investigation into the scope and impact of the incident was ongoing with the assistance of outside advisors and cybersecurity experts. Coca-Cola also notified law enforcement. Crucially for consumers, the company stressed that product quality and safety had not been impacted, and it noted that fairlife's Canadian production operations were not affected by the incident.

A production-line hit, not just an office breach

What set this incident apart from a routine corporate data breach was that the intrusion reached production-related systems — the manufacturing environment — forcing a physical halt to output rather than merely exposing back-office records. fairlife, headquartered in Chicago's West Loop and operating high-volume dairy plants in the United States, is a significant supplier of value-added milk products, so a suspension of US production carried real supply-chain consequences for a widely stocked consumer brand. Coca-Cola did not quantify the expected financial or volume impact in its initial disclosure.

Open questions

As of the days immediately following disclosure, several key facts remained unconfirmed. No ransomware group had publicly claimed responsibility, and Coca-Cola had not stated whether any data was exfiltrated from fairlife's environment or whether the attackers had issued a ransom demand. The company framed the event through the lens of operational disruption and its SEC materiality obligations rather than data theft, and it did not commit to a timeline for restoring US production. With the investigation continuing and the manufacturing outage unresolved at the time of reporting, the incident's status was best characterised as ongoing.