# Ransomware Attack on Coca-Cola's Fairlife Dairy Subsidiary Halts US Production

> Coca-Cola disclosed via SEC Form 8-K that its fairlife, LLC dairy subsidiary detected unauthorized third-party access to a portion of its systems, including production-related systems, in connection with a ransomware event, temporarily suspending U.S. dairy production while Canadian operations continued unaffected.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1427
- **ID:** TL-2026-1427
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On July 16, 2026, The Coca-Cola Company filed a Form 8-K (Item 8.01, Other Events) with the U.S. Securities and Exchange Commission disclosing that its wholly owned dairy subsidiary fairlife, LLC identified unauthorized access by a third party to a portion of its systems, including production-related systems, in connection with a ransomware event. As a direct consequence, production operations at fairlife's United States manufacturing facilities were temporarily suspended; fairlife's Canadian production operations were confirmed unaffected and continued to operate normally. fairlife's affected US product lines include Ultra-Filtered Milk, Core Power Protein Shakes, and Nutrition Plan. Coca-Cola stated that upon detection it 'promptly activated its incident response and business continuity protocols' and that its 'investigation and assessment of the impact of the incident is ongoing, with the assistance of outside advisors and cybersecurity experts.' The Company 'has also notified law enforcement.' The company affirmed that product quality and safety have not been impacted by the intrusion. As of disclosure (reported by BleepingComputer at 05:09 PM ET on July 16, 2026), no ransomware group had publicly claimed responsibility, no ransom demand or amount had been disclosed, and Coca-Cola had not determined whether data was accessed or exfiltrated during the intrusion, nor whether the incident will materially affect the company financially or operationally. The unauthorized access to fairlife's production-related (OT-adjacent) systems and the resulting suspension of manufacturing is consistent with the industry-wide pattern in which ransomware operators disrupt or lock IT systems that dairy/food manufacturers rely on to safely run production lines, forcing precautionary shutdowns even absent direct OT/ICS compromise, to contain lateral spread and protect product safety and integrity. This pattern has repeated across the sector: Schreiber Foods was forced to halt dairy production in a November 2021 ransomware attack; Dairy Farmers of America confirmed a June 2025 cyberattack (later found to have leaked personal data) that was publicly claimed by the Play ransomware gang on June 23, 2025. The Food and Agriculture ISAC's 2025 sector landscape report records 265 ransomware attacks against the food and agriculture sector in 2025 (4.2% of all tracked ransomware incidents, amid an 82% year-over-year rise in overall ransomware incidents, from 3,508 in 2024 to 6,377 in 2025), identifying Qilin, Akira, CL0P, Play, and Lynx as the five dominant groups targeting the sector — alongside RansomHub and LockBit, both separately documented by CISA #StopRansomware advisories as having struck food and agriculture victims. On June 4, 2025, the FBI, CISA, and the Australian Signals Directorate's ACSC jointly updated the Play ransomware advisory (originally AA23-352A) with new TTPs and refreshed IOCs, noting the FBI had identified roughly 900 entities allegedly victimized by Play as of May 2025 using a double-extortion model (encrypt-and-exfiltrate, with victims instructed to contact the actors via email rather than through a fixed ransom note demand). If data was in fact stolen during the fairlife intrusion, actors would likely attempt double-extortion by threatening to publish the data unless a ransom is paid — a pattern consistent with groups such as Play, RansomHub, LockBit, Qilin, Akira, CL0P, and Lynx that have targeted the food and agriculture sector, in some cases (CL0P) via mass zero-day exploitation of file-transfer platforms such as GoAnywhere MFT (e.g., CVE-2025-10035) rather than traditional phishing.

## MITRE ATT&CK

- T1590 Gather Victim Network Information
- T1588.001 Malware
- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059.001 PowerShell
- T1136 Create Account
- T1078.002 Domain Accounts
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1003 OS Credential Dumping
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1021.001 Remote Desktop Protocol
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [Coca-Cola says Fairlife ransomware attack halts US dairy production](https://www.bleepingcomputer.com/news/security/coca-cola-says-fairlife-ransomware-attack-halts-us-dairy-production/)
- [The Coca-Cola Company Form 8-K (Item 8.01)](https://www.sec.gov/Archives/edgar/data/0000021344/000162828026048466/ko-20260716.htm)
- [#StopRansomware: RansomHub Ransomware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a)
- [#StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide)
- [Throwback Attack: Dairy giant forced to halt production because of ransomware (Schreiber Foods, 2021)](https://www.controleng.com/throwback-attack-dairy-giant-forced-to-halt-production-because-of-ransomware/)
- [Dairy Farmers of America confirms June cyberattack leaked personal data](https://therecord.media/dairy-farm-leaked-info-ransomware)
- [Play ransomware gang takes credit for attack on Dairy Farmer's of America](https://itnerd.blog/2025/06/23/play-ransomware-gang-takes-credit-for-attack-on-dairy-farmers-of-america/)
- [Updated Guidance on Play Ransomware](https://www.cisa.gov/news-events/alerts/2025/06/04/updated-guidance-play-ransomware)
- [#StopRansomware: Play Ransomware (updated)](https://www.ic3.gov/CSA/2025/250604.pdf)
- [Understanding Ransomware Threat Actors: LockBit](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a)
- [Navigating the 2025 Food and Agriculture Sector Ransomware Landscape](https://www.foodandag-isac.org/post/navigating-the-2025-food-and-agriculture-sector-ransomware-landscape)
- [From Farm to Fallout: Ransomware's Impact on the Food Chain](https://www.txone.com/blog/from-farm-to-fallout-ransomwares-impact-on-the-food-chain/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1427