Coca-Cola Halts Fairlife Production After Ransomware Attack

What happened

Fairlife, a Coca-Cola subsidiary that produces ultra-filtered milk and protein shakes, identified unauthorised access to its systems by a third party in connection with a ransomware event. The breach affected portions of Fairlife's systems, including those described as production-related. In response, Coca-Cola suspended production operations at all Fairlife facilities in the United States. The company disclosed the incident in an SEC Form 8-K filing on 16 July 2026. Canadian production operations were not affected. Coca-Cola has engaged cybersecurity experts and notified law enforcement, but stated that product quality and safety have not been impacted. No ransomware group has publicly claimed responsibility, and the company has not confirmed whether data was stolen or whether a ransom demand was issued.

Why it matters

The production halt affects a brand that generates approximately $4 billion in annual retail sales and represents a key growth driver for Coca-Cola beyond carbonated beverages. Coca-Cola acquired Fairlife through a deal valued at approximately $7 billion (including contingent payments), making it one of the largest brand acquisitions in the company's history. The attack comes during a period of major expansion: Fairlife recently opened a 745,000-square-foot facility in Webster, New York, expected to become the largest milk processing facility in the Northeast, and is expanding its Coopersville, Michigan plant with commercial production planned for 2028. The timing could disrupt supply plans, as analysts had projected a 25% increase in Fairlife supply for 2026. Consumers who rely on Fairlife's lactose-free ultra-filtered milk and Core Power protein shakes may face tightening supply if the outage extends beyond a few days, as existing inventory on store shelves draws down.

Bigger picture

The Fairlife incident is part of a broader pattern of ransomware attacks targeting food and beverage manufacturing. Ransomware incidents affecting industrial organisations reached 1,020 in the first quarter of 2026 alone, with manufacturing accounting for 62% of all industrial victims. Food and agriculture organisations saw ransomware attacks more than double between Q1 2024 and Q1 2025. Food manufacturers face particularly intense pressure to pay ransoms because dairy production operates on fixed schedules tied to farm deliveries, and perishable inputs cannot wait for IT recovery. Prior attacks on food infrastructure include JBS Foods, which paid an $11 million ransom in 2021 after a shutdown that disrupted approximately 20% of US beef supply. The SEC has intensified scrutiny of cybersecurity disclosure, requiring companies to report material incidents within four business days of determining materiality. Coca-Cola filed under Item 8.01 (Other Events) rather than Item 1.05 (cybersecurity-specific disclosure), stating it has not yet determined whether the incident is reasonably likely to materially affect the company.

What to watch

Investors should monitor how quickly Coca-Cola restores US Fairlife production and whether the company clarifies whether ransomware reached operational technology systems on the plant floor or only affected business IT systems. This distinction will determine the complexity and timeline of restoration. Watch for any follow-on SEC filing under Item 1.05 if Coca-Cola determines the incident is material. Key signals include whether Coca-Cola quantifies financial losses, whether any ransomware group publicly claims responsibility, and whether data exfiltration is confirmed. Retail supply chain dynamics will also be important: if the outage extends beyond a few days, consumers may face tightening availability of Fairlife products, particularly in markets served by the Coopersville, Michigan and Goodyear, Arizona facilities. Any impact on the timeline for ramping up production at the new Webster, New York facility would also signal longer-term disruption.