fairlife Ransomware Attack: Coca-Cola Confirms Data Theft as US Production Restarts

Coca-Cola confirmed on July 27, 2026 that data was taken from fairlife during the ransomware attack, and that the majority of production has resumed at the subsidiary's four US facilities. The company describes the incident as involving access by an unauthorised third party to a portion of its systems and the taking of certain data.

That wording matters. The Form 8-K filed on July 16 described unauthorised access to systems, including production-related systems, but stopped short of confirming exfiltration. Eleven days later the company has closed that gap.

What Coca-Cola still has not said is what the data contains. There is no indication yet of whether it covers employee records, customer information, supplier contracts or purely internal operational material. The company also continues to state that product quality and safety were never affected, and that retail availability held up because existing inventory absorbed the production gap.

fairlife, LLC is a wholly owned Coca-Cola dairy subsidiary that makes ultra-filtered milk, protein shakes and nutrition drinks. It runs four production facilities in the United States and reports more than 1 billion dollars in annual retail sales.

Coca-Cola detected the intrusion and filed its Form 8-K with the SEC on July 16, 2026. The filing said the company had activated its incident response and business continuity protocols, engaged outside advisors and cybersecurity experts, notified law enforcement, and could not yet determine whether the incident was reasonably likely to have a material effect.

When SecurityWeek covered the disclosure on July 17, no known ransomware group had claimed responsibility. That changed within days. Anubis listed fairlife on its extortion site and set a countdown, and Coca-Cola declined to comment on the group's specific allegations when asked.

Anubis is a ransomware-as-a-service operation running a double extortion model, encrypting systems and threatening to publish stolen files. Everything in this section comes from the group's own claims and should be read that way.

The group told BleepingComputer it had encrypted fairlife's Nutanix infrastructure and that recovery without its key was impossible. It also said it had been inside the network about a week before the disclosure, and that Coca-Cola reported the incident rather than following the instructions left on the network. On its leak site the group claimed one terabyte of stolen files and set a deadline for negotiations.

Claimed by Anubis      Confirmed by Coca-Cola
---------------------  ----------------------
1 TB of files stolen   data taken, volume not stated
Nutanix fully encrypted  no comment
no recovery possible   majority of production resumed
ransom demand issued   no comment

That deadline passed on July 27 and the data was made available for download. Coca-Cola has not confirmed the volume, the nature of the encrypted systems, or the existence of a ransom demand.

One tension is worth naming. Anubis said recovery without its decryption key was impossible. Coca-Cola restored the majority of production across four plants within eleven days of disclosure.

Both statements can be true at once. Restoring production does not require decrypting the encrypted estate if usable backups exist, if the affected systems can be rebuilt, or if the plants can run on a reduced set of systems while recovery continues. Coca-Cola has been careful to say the majority of production, not all of it, and that work on impacted systems and operations continues.

What the sequence does show is which half of the extortion worked. The encryption did not force a payment. The threat to publish could not be answered at all: the company got its factories back on its own schedule, but it could not stop the files going out. That asymmetry is exactly why double extortion exists.

The operational impact was total on the US side and zero on the Canadian side. Every US facility stopped. Coca-Cola said in the 8-K that fairlife's Canada production operations were not impacted, and it has repeated that position since.

Consumers largely did not notice. Coca-Cola says retail availability was mostly unaffected because existing inventory covered the interruption, which is a function of shelf stock and distribution lead times rather than of how quickly the systems came back.

The financial picture is still open. The July 16 filing said the company had not determined whether the incident was reasonably likely to have a material effect, and that assessment has not been publicly updated. Coca-Cola is due to report second quarter results on July 28, 2026, which is the next obvious moment for any figure to surface.

The response pattern is textbook, and unusually well documented for a company of this size. Coca-Cola activated incident response and business continuity protocols on detection, brought in outside advisors and cybersecurity experts, and notified law enforcement. It disclosed to the SEC within the reporting window and issued a public update once restoration was substantially under way.

It also declined to engage with the attackers. According to BleepingComputer, the company reported the intrusion to authorities and did not follow the instructions the group left on its network. Anubis complained about precisely that in its own post, which is an unintentional confirmation that the refusal was real.

Coca-Cola has consistently declined to comment on the attacker's specific allegations, including when asked directly about the terabyte figure and the encryption claims.

Three questions stay open as the story moves out of the acute phase.

1. Whether the intrusion reached plant floor systems, or whether production stopped as a precaution when business systems were isolated. Coca-Cola's phrase, production-related systems, does not settle it, and the answer changes how the recovery timeline should be read.
2. What the leaked data contains. Now that the files are public, the contents will be characterised by researchers and journalists rather than by the company, and any notification obligations follow from that.
3. Whether a material impact figure appears. The second quarter results on July 28 are the next scheduled opportunity, though a company is not obliged to quantify an incident whose assessment is still ongoing.