Coca-Cola discloses ransomware attack disrupting fairlife production in the US

The Coca-Cola Company has disclosed that a ransomware attack affecting its wholly owned dairy subsidiary, fairlife, has temporarily halted fairlife's US production operations after attackers gained unauthorized access to part of its network, including production-related systems.

The company announced the incident on July 16 and simultaneously filed a Form 8-K with the US Securities and Exchange Commission (SEC), confirming that fairlife identified unauthorized access by a third party in connection with a ransomware event. Coca-Cola said it immediately activated its incident response and business continuity procedures, engaged external cybersecurity experts and advisors, and notified law enforcement.

According to the company, the investigation remains ongoing, and the full scope, nature, and impact of the intrusion have not yet been determined. As a result, Coca-Cola said it has not yet concluded whether the incident is reasonably likely to have a material impact on the company.

fairlife is Coca-Cola's value-added dairy business, producing ultra-filtered milk, protein shakes, and other dairy beverages sold across North America. While the cyberattack has disrupted manufacturing in the United States, the company said fairlife's Canadian production facilities continue to operate normally.

Coca-Cola emphasized that the incident has not affected product quality or food safety. However, production operations at all affected US fairlife facilities have been temporarily suspended while the company works to investigate the breach, restore impacted systems, and resume normal operations.

The company did not disclose when the ransomware attack occurred, how attackers initially gained access, whether any data was stolen, or whether a ransom demand was made. No ransomware group has publicly claimed responsibility for the attack at the time of writing.

The disclosure was made through both a press release and an SEC Form 8-K, which states that the company is continuing its assessment with the assistance of outside cybersecurity specialists. Coca-Cola said additional information will be provided as its investigation progresses.

For now, Coca-Cola's primary focus is restoring affected systems and resuming US fairlife manufacturing while determining the full extent of the compromise. As the possibility of customer data being exposed has not been ruled out yet, it is advisable that customers who had accounts at fairlife remain vigilant for unsolicited communications.