ATLANTA – The Fairlife protein shakes sitting in grocery refrigerators across the country have not changed yet. But the production lines that fill them have gone silent. Coca-Cola disclosed Wednesday in a federal securities filing that its Fairlife dairy subsidiary was struck by a ransomware attack, forcing an indefinite suspension of all U.S. manufacturing operations.
The disclosure arrived in an 8-K report submitted to the U.S. Securities and Exchange Commission. Coca-Cola confirmed that ransomware had compromised Fairlife’s production systems and that manufacturing across the United States was “temporarily suspended.” No facility count was given, no timeline for restoration was offered, and no ransomware group was named. Canadian operations, the company said, remain unaffected.
The scope of the disruption reflects how central Fairlife has become to Coca-Cola’s portfolio. The brand generates an estimated $4 billion in annual sales, built on ultra-filtered milk with higher protein content and lower lactose than conventional dairy. Its Core Power protein shakes have become fixtures in gym refrigerators and airport convenience stores. Since Coca-Cola completed its full acquisition of Fairlife in 2020, the brand has been among the company’s most consistent growth contributors in North America.
The attack follows a pattern that has made food and beverage companies an increasingly attractive target for ransomware operators. Arizona Beverages, one of the largest U.S. beverage producers, spent weeks in 2019 processing orders manually after ransomware encrypted its systems. Last year, grocery distributor UNFI disclosed a cyberattack that disrupted its distribution centers and left shelves in some retail chains temporarily bare, as TechCrunch reported. Fairlife’s suspension adds a brand of substantially greater consumer visibility to that list.
The speed of the SEC disclosure carries meaning. Under rules the agency adopted in 2023, public companies must file within four business days of determining that a cyberattack is “material,” meaning significant enough to affect investor decisions. Coca-Cola filed the same day the attack became known, suggesting either that the materiality determination was immediate or that the scale of the disruption left little room for deliberation. A $4 billion brand with all U.S. production suspended tends to clear the threshold quickly.
Dairy production also complicates the shutdown in ways that affect other industries differently. Milk has a biological clock that does not pause because IT systems are down. Pasteurization lines must run or the raw supply arriving at idled plants spoils. Equipment must be sanitized on a fixed schedule regardless of whether it is operating. Coca-Cola has not addressed whether incoming raw milk supplies were diverted, returned to farms, or lost. The ransomware event may carry a physical cost that no filing yet reflects.
The Fairlife attack also arrives in a summer that has already strained U.S. food supply chains. A cyclospora parasite outbreak traced to Taco Bell lettuce has sickened nearly 7,000 Americans across 34 states, forcing voluntary ingredient removals and prompting a federal investigation. The pressure on American food logistics in July 2026 is arriving from several directions at once.
Ransomware groups have moved heavily into food and beverage targets partly because the sector’s economics favor fast payment. Margins in dairy and beverage manufacturing are often narrow, production schedules are inflexible, and even a short suspension translates directly into lost revenue with no simple way to recover volume. Criminal groups operating ransomware-as-a-service platforms understand this dynamic. Coca-Cola has not said whether it has received a ransom demand or made any contact with the group responsible.
The filing also did not address whether any data was copied before the attack. Modern ransomware operations increasingly use double extortion: encrypting systems to force payment while simultaneously exfiltrating sensitive information as additional leverage. No group had publicly claimed responsibility for the Fairlife attack as of Thursday morning. Coca-Cola’s 8-K made no mention of data theft, though companies typically do not know the full extent of an intrusion in the hours immediately following discovery.
Coca-Cola’s stock trades under the ticker KO on the New York Stock Exchange and is a component of the Dow Jones Industrial Average. The company said it is working with law enforcement and outside cybersecurity professionals on investigation and remediation but declined to provide a restoration timeline. The financial effect of the suspension will depend on how long Fairlife’s plants remain offline, a question Coca-Cola did not answer in its Wednesday filing.
What is still unknown is when production restarts, whether any consumer or financial data was stolen, and whether a ransom will be paid or demanded. Those answers may arrive in days or in weeks. Until they do, Coca-Cola’s disclosure stands as the only public statement the company has made, confirming only what has stopped, not when it will start again.
