Coca-Cola Confirms Data Breach at Fairlife Subsidiary Following Ransomware Attack

ATLANTA, July 27 (AP) — The Coca-Cola Company confirmed Monday that its dairy subsidiary, Fairlife, has suffered a significant data breach following a ransomware attack attributed to the Anubis cybercriminal group. The incident marks one of the most high-profile cybersecurity events involving major U.S. beverage manufacturers in recent years.

Coca-Cola stated that unauthorized actors gained access to certain systems at Fairlife, encrypting files and exfiltrating sensitive data as part of a ransom demand operation. While the company did not specify the exact volume of compromised information or the specific types of records stolen, it acknowledged that personal data belonging to employees may have been accessed. The breach was detected during routine security monitoring on Sunday evening.

The Anubis group is known for deploying sophisticated malware designed to lock victims out of their networks while simultaneously stealing proprietary and personally identifiable information. In this instance, the attackers reportedly threatened to release stolen data publicly unless a ransom payment was made within a specified timeframe. Coca-Cola has not commented on whether any financial demands were met or if negotiations are ongoing.

Fairlife, based in New Jersey, produces ultra-filtered milk products sold under brands such as Fairlife and Horizon Organic. The subsidiary operates manufacturing facilities across the United States and relies heavily on digital supply chain management systems that appear to have been targeted by the intrusion. Coca-Cola executives emphasized that consumer-facing operations remained largely unaffected during the initial phase of the attack.

The company has engaged leading cybersecurity firms to investigate the scope of the breach and is working closely with federal law enforcement agencies, including the FBI's Cyber Division. No disruption to product availability or distribution networks was reported as of Monday afternoon, though internal communications systems at Fairlife were temporarily offline while IT teams worked to restore access.

Coca-Cola issued a brief statement urging affected individuals to remain vigilant against potential phishing attempts related to the incident. The company declined to provide further details on the nature of the compromised data or whether customer information was involved, citing ongoing investigations and privacy concerns.

As the investigation continues, questions remain regarding how long the attackers maintained access to Fairlife systems before detection and what specific vulnerabilities were exploited. Industry analysts are monitoring the situation closely for potential ripple effects across Coca-Cola’s broader corporate network. The company has not yet announced any plans to notify regulators or affected parties beyond its initial internal assessment.

With no resolution in sight, stakeholders await further updates on whether additional data will be exposed and what steps Coca-Cola intends to take to prevent similar incidents in the future.