Ransomware Attack Halts Fairlife Milk Production Across the US
Coca-Cola told the SEC that hackers broke into its Fairlife dairy subsidiary, forcing the company to stop making protein shakes and ultra-filtered milk at its American plants.
Key points
- Coca-Cola disclosed in an SEC Form 8-K filing that a ransomware attack hit its Fairlife dairy subsidiary.
- Fairlife has temporarily suspended production at all of its US facilities while it restores affected systems.
- Canadian production is not affected, and Coca-Cola says product quality and safety are intact.
- No ransomware gang has claimed the attack, and Coca-Cola hasn't confirmed whether customer or employee data was stolen.
- SEC rules introduced in 2023 require US-listed companies to disclose material cyber incidents within four business days.
Coca-Cola has told regulators that a ransomware attack, meaning malicious software that locks a company's files until it pays a ransom, has forced its Fairlife dairy subsidiary to halt production across the United States.
The disclosure came in a Form 8-K filing with the US Securities and Exchange Commission. Fairlife detected unauthorised access to some of its systems, including those tied to production. The attack was first reported by BleepingComputer.
Fairlife is the Coca-Cola brand behind Core Power protein shakes, ultra-filtered milk and the Nutrition Plan line. Coca-Cola stated in the filing that product quality and safety haven't been affected. What has stopped is the making of new stock.
What actually happened to Fairlife?
Criminals broke into Fairlife's computer systems, including the ones that run the factories. Once ransomware takes hold, files get scrambled and machines refuse to boot until IT staff restore from backups or pay for a decryption key.
Coca-Cola said it "promptly activated its incident response and business continuity protocols" after spotting the intrusion, brought in outside cybersecurity experts and notified law enforcement.
Production at Fairlife's US plants is down while engineers rebuild. Canadian operations are still running. The company hasn't said how the hackers got in, when the intrusion began, or how long the shutdown will last. It also hasn't confirmed whether files were stolen before the ransomware fired, which is now the standard playbook: steal first, encrypt second, extort twice.
Was any customer data stolen?
Coca-Cola hasn't said. No ransomware group has publicly claimed the attack, and there's no leak-site listing so far.
That could change. Most modern ransomware crews wait days or weeks before naming a victim on their extortion blog, using that window to squeeze the company privately. If Fairlife holds HR records or supplier contracts, any of it could surface later.
The company said in its filing that it hasn't yet determined whether the attack is "reasonably likely to materially affect" its business. Under SEC rules introduced in 2023 for cyber incident disclosure, US-listed companies must file an 8-K within four business days of deciding an incident is material. This is the sixteenth ransomware story we've tracked in the past 30 days, and the pattern is consistent: the data question outlasts the production outage by weeks.
Should you worry?
For shoppers, not immediately. Existing stock is safe. Expect shelf gaps for Core Power and Fairlife milk over coming weeks as inventory runs down.
For Fairlife employees, watch your inbox. If the attackers took HR files, phishing emails, fake messages designed to trick you into handing over passwords or bank details, tend to follow within weeks. Treat any urgent "HR update" or "payroll verification" message with suspicion and confirm through a known internal channel before clicking anything.
Anyone who bought from Fairlife through a loyalty or subscription programme should monitor the email address they used and change the password if it was reused elsewhere.
The investigation is ongoing.
