The news: Coca-Cola said in an SEC filing that a ransomware attack hit its Fairlife dairy business and forced it to suspend all US production. Fairlife’s Canadian operations are still running.
The attack reached Fairlife’s production systems, not just its office network, according to the filing.
What’s down: Fairlife makes ultra-filtered milk and Core Power protein shakes. The brand passed $1 billion in annual US retail sales in 2021. Coca-Cola has invested more than $1.3 billion into new Fairlife plants in Michigan and New York since then.
Coca-Cola said product quality and safety were not affected. It has notified law enforcement.
What's unclear: Coca-Cola has not said which plants stopped or when production will restart. It has also not said whether the attackers got into the systems that physically run the production lines, or whether Fairlife took those systems offline as a precaution.
No ransomware group has claimed the attack so far. The company said it does not yet know whether the damage will be material.
The precedent: Companies have been through this before, and the recovery times vary widely. JBS paid an $11 million ransom in 2021 and had most of its US meat plants running again within days. Molson Coors needed about a week that same year. The outage pushed as much as 2 million hectoliters of beer production into later quarters.
The longer cases are the warning. After a 2023 attack, Clorox ran its factories and orders on manual processes for about six weeks and tied a $356 million drop in quarterly sales to the disruption. Jaguar Land Rover halted vehicle production for roughly five weeks in 2025.
What's next: Coca-Cola reports quarterly earnings later this month.
