Cyber Incident Victim: Coca-Cola
Date:
Jul 2026
Location:
United States of America
Summary
Coca-Cola resumed production of its Fairlife milk beverages after a ransomware attack forced the temporary shutdown of four U.S. plants. The company said an unauthorized third party accessed some of Fairlife’s technology systems, leading it to halt operations while noting that product quality and safety were unaffected. Hackers obtained certain data, but the company stated that retail availability remained largely unchanged thanks to existing inventory and that it does not expect a meaningful impact on sales. Fairlife, acquired in a prior deal for about seven billion dollars, generates annual sales exceeding three billion dollars.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On July 16, Coca-Cola issued a statement announcing that an unauthorized third party had gained access to some of Fairlife's technology systems, which the company described as a ransomware attack. In response to the breach, Coca-Cola decided to temporarily halt Fairlife milk production at four of its plants located across the United States. The company explicitly noted that the interruption did not affect the quality or safety of any Fairlife products. By July 27, Coca-Cola reported that it had made significant progress in restoring service at the affected facilities and had resumed the majority of Fairlife milk production.
Coca-Cola also disclosed that the attackers had obtained certain data, although the specific nature of that data was not detailed in the statement. The company indicated that it continued to collaborate with internal and external teams to fully restore all production operations. Despite the operational disruption, Coca-Cola said that retail availability of Fairlife products remained largely unaffected because existing inventory levels were sufficient to meet demand. The firm reiterated that product quality and safety had not been compromised at any point during the incident. Coca-Cola further stated that it does not anticipate the cyberattack will have a meaningful impact on its overall sales, referencing the brand’s strong market position.
For context, Coca-Cola acquired the Fairlife brand from Select Milk Producers in 2020 for an estimated seven billion dollars. Fairlife represents one of the approximately two hundred beverage brands within Coca-Cola’s portfolio and generates annual sales in excess of three billion dollars. The ransomware incident was confined to the Fairlife division, with no reported effect on other Coca-Cola business units or product lines. In its July 27 update, Coca-Cola emphasized that it had resumed the majority of production and was continuing efforts to bring all four plants back to full operational status.