Coca-Cola confirms hackers stole data in Fairlife ransomware attack

Coca-Cola has confirmed that the ransomware attack on its dairy subsidiary Fairlife involved the theft of company data, weeks after the incident temporarily halted production at its US facilities.

Fairlife is a Coca-Cola-owned dairy brand that makes ultra-filtered milk and protein drinks, with annual retail sales that have topped $1 billion.

In a statement published on Monday, Coca-Cola said Fairlife has resumed the majority of production across its four US manufacturing facilities.

“The company previously disclosed that fairlife experienced a ransomware event. This event involved access by an unauthorized third party to a portion of the company’s systems and taking of certain data, and a temporary suspension of production operations,” reads the Coca-Cola statement.

Coca-Cola said it’s still working to restore the affected systems, and that retail shelves have stayed stocked thanks to existing inventory.

“Product quality and safety have not been impacted,” it added.

The company also stated that, based on the information available so far, it does not expect the incident to have a material impact on its financial results.

Coca-Cola disclosed the incident on July 16, 2026, in a Form 8-K filed with the U.S. Securities and Exchange Commission (SEC), revealing that a ransomware attack had disrupted production operations at Fairlife.

After discovering the breach, the company suspended production, activated its incident response and business continuity plans, engaged external cybersecurity specialists, and notified law enforcement.

On July 20, the Anubis ransomware group added Fairlife to its dark web leak site, claiming it had encrypted servers and stolen 1 terabyte of confidential data. The group threatened to publish the files unless the company entered negotiations.

Coca-Cola has not confirmed the volume or nature of any data stolen, and the ransomware group’s claims remain independently unverified.

Anubis operates as a Ransomware-as-a-Service (RaaS) platform, allowing affiliates to carry out attacks involving data theft, file encryption, and an optional file-wiping feature. The group emerged in late 2024 as a rebrand of the earlier Sphinx ransomware, marked by a switch from the .sphinx to the .anubis file extension on encrypted files.