On July 16, 2026, Fairlife LLC, the dairy subsidiary of The Coca-Cola Company, disclosed a ransomware intrusion that compromised its systems and forced the suspension of all US production operations. Coca-Cola filed a Form 8-K with the US Securities and Exchange Commission the same day under Item 1.05, the material cybersecurity incident provision, stating that Fairlife had identified unauthorized access to a portion of its systems “including its production-related systems” in connection with a ransomware event.
Fairlife generates approximately $4 billion in annual sales and operates ultra-filtration processing facilities across the United States producing filtered milk, protein shakes, and creamers. Canadian production operations continued unaffected. The company activated incident response and business continuity protocols, engaged external cybersecurity advisors, and notified law enforcement.
The extent to which ransomware reached plant-floor operational technology systems directly remains unconfirmed. The 8-K language citing “production-related systems” places those systems within the incident perimeter, but does not distinguish between enterprise IT systems (ERP, MES) and process control systems (PLCs, HTST pasteurization controllers, ultra-filtration membrane controls). Cybersecurity Dive and The Register both noted this ambiguity in their coverage. The pattern is consistent with JBS Foods in 2021, where ransomware reached IT systems supporting production and caused a precautionary shutdown of beef and pork processing lines across the United States and Australia before any confirmed OT-layer encryption was publicly disclosed.
No ransomware group has claimed the attack, and no extortion demand or ransom payment has been publicly confirmed. The recovery timeline was not disclosed as of July 17, 2026. Coca-Cola noted in the 8-K filing that the company had not yet determined whether the incident was reasonably likely to materially affect its consolidated financials.
This is the first SEC Item 1.05 material cybersecurity disclosure in 2026 to explicitly cite production system impact at a US food manufacturer. The Fairlife ransomware incident is catalogued in the database with reliability rated “Likely But Unconfirmed,” reflecting the confirmed production suspension and SEC disclosure alongside the unresolved question of OT system penetration depth.