Coca-Cola has confirmed that its dairy subsidiary Fairlife suffered a ransomware event in July 2026 that involved unauthorized third-party access to a portion of its systems, the taking of certain data, and a temporary suspension of US production operations. The company disclosed the incident in a Form 8-K filed with the SEC on July 16 and confirmed the data theft in a statement on July 27, by which point the majority of production had resumed across Fairlife's four US facilities. The Anubis ransomware group claimed the attack on its leak site on July 20 and has since given a far more expansive account to researchers: roughly 500 compromised hosts, 1 TB of stolen data across 546,573 files, a $15 million ransom demand, and a victim that never came to the table. Coca-Cola has confirmed none of those figures.
What Happened
The public timeline is well established across the reporting. On July 16, 2026, Coca-Cola disclosed via SEC Form 8-K that Fairlife had identified unauthorized access by a third party to a portion of its systems, including production-related systems. The company activated incident response and business continuity plans, engaged external cybersecurity specialists, notified law enforcement, and took operations offline. AP reported that US production was paused outright; Coca-Cola stated at the time that product quality and safety were not impacted and that Fairlife's Canadian operations continued as normal.
On July 20, the Anubis ransomware group added Coca-Cola and Fairlife to its dark web leak site, claiming it had encrypted servers and stolen approximately 1 TB of confidential data, and threatening publication unless the company entered negotiations by the end of that week. Anubis told BleepingComputer it had encrypted Fairlife's Nutanix infrastructure, "leaving no possibility of recovery," and that it had attacked roughly a week before the company's public disclosure.
Accounts differ on the extortion demand itself. The AJC, examining the leak site post on July 21, reported that Anubis did not specify a ransom amount, writing only that a "token agreement is all it takes" alongside the taunt "Be smart and give the people back their milk, damn it! The timer is ticking," with a deadline set for the morning of Monday, July 27. The Data Breach Times, relaying an interview Anubis gave to SuspectFile and published August 21, puts the demand at $15 million. Both figures come from the attacker; neither is corroborated by Coca-Cola. The AJC also noted the original Anubis site was unreachable on July 23 and that the group was mirroring the claim on a second site.
Coca-Cola's July 27 statement was brief: "The company previously disclosed that fairlife experienced a ransomware event. This event involved access by an unauthorized third party to a portion of the company's systems and taking of certain data, and a temporary suspension of production operations." The company said retail availability was largely unimpacted thanks to existing inventory, that restoration work was ongoing, and that based on currently available information it does not believe the incident has had or is reasonably likely to have a material impact on its financial condition or results of operations. A spokesperson declined to validate the threat actor's specific allegations.
What Was Taken
Coca-Cola has confirmed only "the taking of certain data" and has not disclosed volume, type, or whether personal information was involved. Everything more specific traces back to Anubis.
Volume claims range as follows. Anubis's original leak-site listing claimed approximately 1 TB, a figure carried consistently by BleepingComputer, SecurityWeek, Help Net Security, and the AJC. Infosecurity Magazine, citing screenshots posted to X, reported the group claimed 671 GB and said it had leaked that trove on its blog. The Data Breach Times account reconciles these: Anubis told SuspectFile the full haul was 1 TB across 546,573 files, of which 671 GB has been published so far. That reconciliation is plausible but rests on a single OTHER-tier source relaying attacker claims.
On content, Infosecurity reported the claimed data includes HR records, engineering and technical documentation, and production data. No source confirms consumer or customer personal data. SecurityWeek offered the appropriate caveat directly: extortion gangs routinely exaggerate the importance of what they have stolen in order to pressure victims, and the exact nature of the compromised data remains unclear.
The 500-host figure is attacker-sourced and uncorroborated. If accurate, it would describe an enterprise-wide compromise rather than a contained intrusion, which is consistent with the operational impact actually observed: a full US production stoppage across four plants at a business with more than $1 billion in annual retail sales.
Why It Matters
This incident is a clean case study in the divergence between operational recovery and data-theft consequences. Coca-Cola restored the majority of production within roughly eleven days and absorbed the shelf impact with existing inventory. The stolen data does not expire on that schedule.
Ross Filipek, CISO at Corsica Technologies, framed the durable risk for Infosecurity: "That information creates options. Criminals could impersonate executives or vendors. They could redirect payments or target employees with convincing phishing messages. Operational details could also reveal which suppliers are essential and where future disruption would create the most pressure." His broader point is the one defenders should carry away: internal business data is not harmless merely because it is not customer-facing.
The refusal to negotiate also matters. Anubis's own framing, per both BleepingComputer and the SuspectFile account, is that Fairlife reported the incident immediately and never engaged. Coca-Cola went to authorities as soon as the breach was discovered and did not follow the attacker's instructions. The consequence was a full publication cycle rather than a quiet resolution, and the group leaked accordingly. Organizations should plan for that outcome explicitly rather than discovering their tolerance for it mid-incident.
Anubis itself has been active since December 2024 and has listed roughly 100 organizations on its leak site, per SecurityWeek, operating a standard double-extortion model. Emory University's Ramnath Chellappa cautioned in the AJC's coverage that ransomware group names and compositions shift frequently, and that realistically only the victim can verify a claim's legitimacy, a useful reminder when weighing attacker-supplied telemetry.
The Attack Technique
The only account of initial access comes from Anubis via SuspectFile, as relayed by The Data Breach Times, and should be read as an attacker's self-description rather than confirmed incident response findings. In that account, the group exploited a vulnerability in a corporate VPN and needed roughly one week to move from that foothold to highest-privilege access across all systems, followed by system shutdown, production stoppage, and exfiltration. The one-week window is loosely consistent with what Anubis separately told BleepingComputer, that it attacked about a week before Coca-Cola's July 16 disclosure. No specific CVE, VPN vendor, or product has been named in any source.
Post-access, the more actionable detail is the target: Anubis told BleepingComputer it encrypted Fairlife's Nutanix systems. Hypervisor and virtualization-layer encryption is the pattern that turns a host compromise into a plant shutdown, because a single successful action against the virtualization control plane takes down every workload running on it simultaneously. The claim that recovery was impossible is the attacker's assertion and is contradicted in practice by Coca-Cola restoring most production within about two weeks.
What Organizations Should Do
-
Treat internet-facing VPN and remote access appliances as tier-zero. Patch them on an emergency cadence rather than a normal one, subscribe to vendor advisories directly, and confirm that no management interface is exposed to the internet. This is the claimed entry point here and remains among the most common in enterprise ransomware.
-
Harden the virtualization control plane separately from the guests it hosts. Nutanix, VMware, and equivalent management planes need dedicated administrative accounts, phishing-resistant MFA, isolated management networks, and logging that is shipped off the platform. Backups of virtualized workloads must live somewhere the hypervisor admin credentials cannot reach.
-
Test the immutable, offline restore path end to end. The metric that matters is not whether backups exist but how long a full production restore actually takes when the virtualization layer is gone. Fairlife's outage window is a reasonable benchmark to measure your own plan against.
-
Instrument for privilege escalation and lateral movement on a one-week clock. An intrusion that reaches domain-wide privilege in seven days is not fast by current standards. Detection engineering should target the intermediate steps, credential dumping, anomalous service account use, and mass authentication across hosts, not just the encryption event.
-
Segment IT from OT and production systems. Production stopped here because production-related systems were in reach of the same intrusion. Enforced network segmentation with brokered, monitored crossings between corporate IT and manufacturing environments limits a business-network compromise to the business network.
-
Inventory and restrict sensitive internal business data. HR files, engineering documentation, and supplier and production records deserve the same access controls, monitoring, and separation applied to regulated customer data. Egress monitoring capable of flagging bulk transfers on the order of hundreds of gigabytes should be in place and tuned.
-
Decide your extortion posture before an incident, in writing. Coca-Cola reported to law enforcement immediately and declined to negotiate, and then handled a public leak. That is a defensible position, but only if legal, communications, and executive stakeholders have pre-agreed to it and the leak-response playbook already exists.
Sources: 500 Hosts, 1 TB and No Negotiation: Anubis Reveals Its Fairlife Att... | Coca-Cola confirms data theft in Fairlife ransomware attack | Anubis ransomware claims Coca-Cola Fairlife attack, threatens data... | Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack - S... | Coca-Cola confirms hackers stole data in Fairlife ransomware attack... | Coca Cola Reveals Subsidiary Fairlife Suffered Data Breach - Infose... | Fairlife milk goes offline in the US as Coca-Cola probes a ransomwa... | Group claims credit for hacking Coca-Cola dairy brand Fairlife