Fairlife

Summary

Anubis ransomware group accessed Fairlife systems, stole about a terabyte of data, encrypted production systems, and demanded a token payment. In response, Coca‑Cola halted U.S. production for roughly eleven days while Canadian operations continued and existing inventory maintained retail supply, and the company filed an SEC 8‑K, engaged external counsel and law enforcement.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In July 2026 a criminal ransomware gang publicly claimed responsibility for an attack against Fairlife, the dairy subsidiary of the Coca‑Cola Company, stating that the intrusion forced the firm to temporarily halt its production operations. Fairlife, known for its ultra‑filtered milk products, protein shakes and other nutritional beverages, reported approximately three billion dollars in annual sales and had been owned by Coca‑Cola since its acquisition in 2020. According to the reporting, the threat actors responsible for the breach were identified as the Russian‑linked group Anubis, which gained access to Fairlife’s information technology systems and subsequently deployed ransomware across the network. The attackers asserted that they had exfiltrated roughly one terabyte of sensitive data from the company’s servers and threatened to release that information publicly unless a ransom demand was satisfied. In addition to the data theft, the intruders managed to reach and encrypt Fairlife’s production control systems, thereby affecting the machinery and software that direct the manufacturing of its dairy and beverage lines. Upon discovering that its production environment had been compromised, Coca‑Cola’s leadership made the decision to voluntarily shut down all of Fairlife’s United States‑based manufacturing facilities as a precautionary measure to prevent further spread of the ransomware and to preserve the integrity of the supply chain. The suspension of U.S. production persisted for approximately eleven days, during which time the company’s Canadian operations continued to run unaffected. Fairlife indicated that it maintained sufficient finished‑goods inventory to keep retail customers supplied despite the domestic shutdown, thereby avoiding immediate product shortages in the market.

The incident prompted a series of formal response actions by Fairlife and its parent corporation. Within the required regulatory timeframe, the companies filed a Form 8‑K with the Securities and Exchange Commission to disclose the material cybersecurity event to shareholders and the investing public. Concurrently, Fairlife engaged external cybersecurity counsel to provide specialized legal and technical guidance throughout the investigation and remediation process. Law‑enforcement authorities were notified promptly and participated in the response effort, although the public record does not specify which agencies were involved or the extent of their collaboration. According to the narrative provided by the industry commentators, Fairlife possessed a pre‑existing incident response plan that was activated during the crisis; the plan was executed as designed and contributed to limiting the overall scope of the disruption. The commentators noted that the company’s preparedness, including tabletop exercises and war‑gaming activities, enabled a coordinated reaction that helped contain the ransomware’s impact on both information technology and operational technology environments. No public statement from Fairlife or Coca‑Cola disclosed whether a ransom payment was made, and the attackers did not specify a monetary amount, instead requesting only a token gesture as compensation for the alleged data theft.

Several details surrounding the breach remain unspecified in the source material. The initial infection vector used by Anubis to gain entry into Fairlife’s networks is not described, nor is there any confirmation of whether the claimed terabyte of data was actually exfiltrated or successfully encrypted by the ransomware. The public communications from the ransomware group did not include a concrete financial demand, leaving the nature of the extortion ambiguous. While the article notes that the attackers threatened to make the stolen data public if their request was not met, it does not record any subsequent leak of information or any follow‑up communication from the gang after the production shutdown. The narrative also does not provide information on the total financial cost incurred by Fairlife or Coca‑Cola as a result of the incident, including any expenses related to incident response, legal counsel, regulatory filing, or potential lost revenue during the eleven‑day U.S. production halt.

The account concludes with the observation that Fairlife’s handling of the event was characterized by a timely regulatory disclosure, the engagement of external expertise, rapid law‑enforcement notification, and the execution of an established incident response plan, which together shaped the observable course of the breach and its immediate aftermath.

Sources

Sources available to members: 1 source.