Coca-Cola Halts Fairlife Production After Ransomware Attack Disrupts U.S. Operations

Coca-Cola has stopped production at its Fairlife dairy facilities across the United States after a ransomware attack disrupted some of its computer systems. The incident has become another example of how cybercriminals continue to target large manufacturers and interrupt daily operations.

The company shared details of the attack in a filing with the U.S. Securities and Exchange Commission (SEC). According to the filing, Fairlife found unauthorized access inside some of its information technology systems, including systems that support production.

Coca-Cola acted quickly after finding the attack. The company activated its incident response plan and business continuity plan. It also brought in outside cybersecurity specialists to help investigate the incident and recover affected systems.

The company confirmed that it has also informed law enforcement while the investigation continues. Even with the disruption, Coca-Cola said the quality and safety of Fairlife products remain unchanged.

However, the company decided to pause production at its U.S. Fairlife facilities while recovery work continues. Fairlife’s operations in Canada have not been affected and are still running normally.

Company Continues Investigation as Several Questions Remain

Coca-Cola said its investigation has not finished. The company is still working with outside advisers and cybersecurity experts to understand the full scope of the attack. According to Coca-Cola, the investigation is still ongoing with help from external advisers and cybersecurity specialists. The company also confirmed that it has reported the incident to law enforcement.

The company has not yet determined whether the attack will have a major effect on its financial condition or its overall business. It said the review is still underway, and recovery efforts continue. Several important questions also remain unanswered.

Coca-Cola has not said whether the attackers copied company data before locking systems with ransomware. It has also not revealed whether it received an extortion demand. The company has also not identified the group behind the attack. As of the time of publication, no known ransomware group has publicly claimed responsibility for the incident.

Fairlife is a Chicago-based dairy company that Coca-Cola fully owns. The company produces ultra-filtered milk, Core Power protein shakes, and Nutrition Plan beverages. These products are sold across the United States.

Coca-Cola has not announced any product shortages. Still, a longer production shutdown could reduce product availability if recovery takes more time than expected. The company has also not shared when its U.S. Fairlife facilities will return to normal operations.

Manufacturers Continue to Face Growing Ransomware Threats

Cybersecurity experts have warned that manufacturers have become attractive targets for ransomware groups. These attacks often do more than steal information. They also stop production and create costly downtime.

When factories stop operating, companies face pressure to restore services as quickly as possible. The targeting of critical infrastructure extends beyond manufacturing; a hacker has claimed the theft of 890GB of data from an Iranian nuclear facility. That pressure can increase the damage caused by an attack and make recovery more difficult.

Food producers have also become regular targets because even short production delays can affect supply chains and daily business operations. The Fairlife incident follows a wider pattern seen across many industries.

Over the past few years, ransomware groups have increasingly targeted manufacturers, food suppliers, healthcare organizations, and retailers. Many attackers now focus on disrupting business operations instead of relying only on stolen data.

Shutting down production can sometimes create greater pressure than stealing files alone. As a result, companies may have to spend significant time and resources restoring systems before normal operations can resume.

Recovery Efforts Continue While Investigators Search for Answers

For now, Coca-Cola says its main goal is restoring affected systems and safely restarting production at its U.S. Fairlife facilities. The company has not provided a recovery timeline. Investigators are still examining the incident to understand exactly what happened.

Officials are also working to determine whether any company data left its systems during the attack. They are also trying to confirm whether the attackers demanded payment and identify those responsible. More details may become available as the investigation progresses.

Until then, Coca-Cola says it remains focused on recovering affected systems, supporting its investigation, and bringing Fairlife’s U.S. production facilities back into operation safely.