Fairlife LLC (Coca-Cola) ransomware attack halts all US dairy production

On July 16, 2026, Fairlife LLC, Coca-Cola's dairy subsidiary, disclosed that ransomware had breached its systems, including systems related to production, forcing the suspension of all US production operations. Fairlife is the leading premium dairy brand in the United States, operating ultra-filtration processing facilities that produce filtered milk, protein shakes, and creamers; the subsidiary generated approximately $4 billion in annual sales in 2024. The Coca-Cola Company filed a Form 8-K Item 1.05 material cybersecurity disclosure with the US Securities and Exchange Commission on July 16, stating that fairlife had identified unauthorized access by a third party to a portion of its systems, including its production-related systems, in connection with a ransomware event. The company activated incident response and business continuity protocols, engaged external cybersecurity experts, and notified law enforcement. Canadian production operations continued unaffected. No ransomware group claimed the attack, and no extortion demand or ransom payment was publicly confirmed. Whether the ransomware directly encrypted plant-floor operational technology governing pasteurization, ultra-filtration, or packaging automation, or whether production was suspended as a precautionary measure after supporting IT systems were compromised, was not disclosed as of July 17, 2026.

All US Fairlife production operations suspended as of July 16, 2026, with no recovery timeline disclosed. Canadian operations continued unaffected. No product quality or food safety incidents were reported. Fairlife's US plants produce ultra-filtered dairy beverages and protein products; the suspension affected supply across the company's retail and foodservice customer base during an expansion year in which Jefferies had projected a 25 percent increase in Fairlife production capacity. Financial losses, ransom demand, and ransom payment status were not disclosed.