Anubis Ransomware Group Claims Fairlife Attack, Threatens to Leak 1 TB of Data
Coca-Cola's milk brand has a week to pay an undisclosed ransom, or criminals say they will publish what they took.
Key points
- Anubis listed Coca-Cola and Fairlife on its public extortion site on 20 July 2026, claiming responsibility for a ransomware attack.
- Coca-Cola confirmed production at Fairlife was suspended following the attack; the full impact was still being assessed at disclosure.
- Anubis claims to have encrypted Fairlife's servers and stolen 1 TB of confidential data.
- Coca-Cola has one week from the 20 July listing to pay before Anubis says it will publish what it took.
- Anubis has been active since December 2024 and has listed roughly 100 organisations on its leak site.
A criminal group called Anubis has claimed responsibility for a ransomware attack on Fairlife, the dairy brand owned by Coca-Cola. Ransomware is malicious software that locks a company's files until a payment is made. Fairlife makes protein shakes and ultra-filtered milk sold across North America.
Coca-Cola confirmed production at Fairlife had been suspended. The company said it was still assessing the full scale of the damage. We covered the production shutdown when it was first disclosed, on 16 July 2026, in our earlier story on the attack.
On 20 July 2026, Anubis published the companies' names on its leak site, a website criminals use to pressure victims by threatening to release stolen files publicly. The group claims to have encrypted Fairlife's servers and removed 1 TB of confidential data.
What does this mean for ordinary people?
Fairlife hasn't confirmed that customer or employee personal information was taken. That could change as the investigation continues. The 1 TB Anubis describes could contain internal business documents or customer records; no specific personal data categories have been confirmed.
Anubis runs what's known as a double-extortion model. First, it encrypts the victim's files so the business can't function. Second, it copies those files and threatens to release them, giving criminals two ways to press for payment.
The group also caught attention from security researchers for a "wiper mode" that can permanently delete a victim's files rather than simply encrypt them, making recovery impossible even if backups exist. That's a meaningful escalation beyond typical ransomware.
Anubis told Coca-Cola it could have systems restored within hours if a ransom is paid. The deadline, based on the 20 July listing, gives the company roughly one week. Coca-Cola hadn't responded publicly to SecurityWeek's request for comment at the time of their report.
Should you worry?
If you're a Fairlife customer or employee, watch for a breach notification letter from Fairlife or Coca-Cola. If one arrives, follow its specific instructions. Check bank statements and any account where you've reused a Fairlife password, change that password, and turn on two-step verification, where a text or app code is required alongside your password, wherever it's offered. If the company eventually confirms no personal data was taken, no further action is needed.
The detail worth watching isn't the ransom deadline. It's whether Anubis actually releases the data, because that's when the real harm to individuals begins.
