Cyberattacks are increasingly disrupting consumer-facing industries, including food and beverage manufacturing. That broader risk came into sharper focus on July 16, when Coca-Cola disclosed a ransomware-related technology disruption at its Fairlife dairy business. For a brand with more than $3 billion in annual retail sales, the incident quickly became a concrete example of how digital breaches can interrupt physical food production.
Coca-Cola confirmed a ransomware incident disrupted Fairlife production
The Coca-Cola Company said on July 16 that Fairlife, its Chicago-based dairy unit, identified unauthorized access by a third party to part of its systems, including production-related systems. In the company’s statement and subsequent coverage by Reuters and The Associated Press, Coca-Cola said the incident was connected to a ransomware event and that Fairlife temporarily suspended production operations in the United States. The company also said product quality and safety were not affected.
That production pause is significant because Fairlife is not a niche label. According to AP, the brand generates more than $3 billion in annual retail sales and sells filtered milk, lactose-free dairy products, and protein shakes across the U.S. market. When a company of that scale takes manufacturing offline, the impact reaches well beyond corporate IT and into grocery, club, and convenience channels.
As of July 21, Reuters reported that the hacking group Anubis had claimed responsibility and said it stole 1 terabyte of data, while threatening to publish it unless an unspecified ransom was paid. Coca-Cola had not confirmed that claim at the time of that report, and the company had not publicly disclosed whether data was stolen or what ransom demand, if any, had been received.
What the disruption means in the U.S. market, including local store shelves
What is confirmed is that the production suspension applied to Fairlife’s U.S. operations, while Canadian operations were not affected, according to Coca-Cola and AP. For shoppers in the United States, that means any impact would likely be tied to domestic production and distribution rather than a companywide global shutdown. Reuters also reported that U.S. facilities were temporarily affected after the hack.
What is not yet known is how the interruption has affected specific states, cities, retailers, or product lines. Coca-Cola has not released a full list of affected U.S. stores, regions, or SKUs, and it has not publicly broken out how much inventory was already in the distribution pipeline when production stopped. That means there is not yet verified public data showing which local markets saw the earliest shortages or whether high-volume items such as protein shakes were affected differently than milk.
For consumers, the most immediate effect may be inconsistent shelf availability rather than a food safety issue. Coca-Cola stated that product safety and quality were not impacted. The open question is duration: as of the latest public reporting, the company said it was still investigating, working with cybersecurity experts, notifying law enforcement, and taking steps to restore operations.
Why Fairlife became a warning sign for the food and beverage sector
Food Processing described the incident as a wake-up call for the broader food and beverage industry, pointing to the way manufacturing companies tie corporate information technology systems closely to operational technology on the plant floor. That matters because an intrusion that begins in office networks can affect batching, packaging, production controls, and other systems needed to keep food plants running.
In Food Processing’s reporting, Hub International executive Nicholas Cacciola said the risk is sector-wide rather than isolated. He said food and beverage manufacturers are attractive targets because IT and operational technology are tightly connected, and because email fraud, vendor impersonation, and phishing remain common entry points. The publication also noted that artificial intelligence is helping attackers create more convincing fraudulent communications.
That context helps explain why the Fairlife incident resonated beyond Coca-Cola. The company has said it is investigating and restoring affected operations, but the event already demonstrated a practical reality for customers: when cyber incidents hit production-related systems at a major food brand, the disruption can move quickly from servers to supply chains. For now, Coca-Cola’s public position remains that the investigation is ongoing and product safety has not been compromised.