The Fairlife ransomware attack has temporarily halted production operations at Coca-Cola-owned dairy company fairlife in the United States after unauthorized access was detected in a portion of its systems, including production-related systems.
According to The Coca-Cola Company, fairlife identified unauthorized access by a third party in connection with a ransomware event. Following the discovery, the company activated its incident response and business continuity protocols while launching an investigation with the support of external advisors and cybersecurity experts. Law enforcement has also been notified.
The company said the investigation is ongoing and that the full scope, nature, and impact of the incident are not yet known.
Fairlife Ransomware Attack Suspends U.S. Production
The Fairlife ransomware attack has resulted in the temporary suspension of production operations at fairlife facilities across the United States. However, the company stated that product quality and safety have not been affected by the incident.
According to the company’s statement, fairlife’s production operations in Canada remain operational and have not been impacted by the ransomware event.
The Coca-Cola Company also confirmed in a Form 8-K filing dated July 16, 2026, that fairlife detected the unauthorized access on Thursday. The filing reiterated that the company immediately activated its incident response procedures and business continuity protocols after identifying the intrusion.
While the company continues to assess the incident, it said it has not yet determined whether the ransomware attack is reasonably likely to materially affect its business because the full impact remains unknown.
The company added that it is working to complete its investigation and restore affected systems and production operations as quickly as possible.
Investigation Into Unauthorized Access Continues
The ongoing investigation is being conducted with assistance from outside cybersecurity experts. According to the company, the incident involved unauthorized access to a portion of fairlife’s systems, including systems related to production.
At this stage, The Coca-Cola Company has not disclosed how the attackers gained access, whether any data was compromised, or if a ransomware group has claimed responsibility for the attack.
The company emphasized that its assessment is still underway and that additional details will be shared as more information becomes available.
Food and Beverage Sector Faces Growing Cybersecurity Risks
The food and beverage cyberattack trend has continued to affect manufacturers and logistics providers worldwide in recent months.
On July 16, a cyberattack targeting Nichirei disrupted food deliveries across Japan after the frozen food and logistics provider confirmed unauthorized access to its servers. The incident affected logistics operations supporting KFC Japan, leading to temporary service disruptions while systems were being restored.
Earlier this year, in February 2026, Australian poultry processor Hazeldenes also experienced a cybersecurity incident that disrupted production across its network. The Victoria-based company later announced it had begun a phased return to production to restore operations safely and securely while investigations continued.
The latest incident involving fairlife adds another major food producer to the list of companies dealing with operational disruptions linked to cyber incidents. While production has been paused at fairlife’s U.S. facilities, the company has maintained that product quality and safety remain unaffected and that its Canadian production continues without disruption.
As the investigation progresses, The Coca-Cola Company said it remains focused on restoring impacted systems and resuming normal production operations. The company also noted that the complete scope and potential business impact of the incident have not yet been determined.
