Fairlife’s Ransomware Shutdown Hits a Milk Brand With No Spare Capacity

Coca-Cola’s Fairlife dairy brand has stopped bottling anything in the United States after hackers broke into the systems that run its plants. The company disclosed the ransomware attack Thursday in a filing with the Securities and Exchange Commission, saying a third party gained unauthorized access to a portion of Fairlife’s networks, including systems tied directly to production.

Coca-Cola says the milk already on shelves is safe. What the filing does not say is how long the plants stay quiet, or what a shutdown looks like for a brand that has spent the past two years telling investors it could not make the stuff fast enough.

A Ransomware Event Nobody Has Claimed

The disclosure came in a Form 8-K, the document public companies file within days of a material event. Coca-Cola said Fairlife, the wholly owned dairy subsidiary based in Chicago, identified unauthorized access to a portion of its systems, including production-related systems, in connection with a ransomware event.

Product quality and safety have not been impacted. However, as a result of the incident, production operations at fairlife in the United States are temporarily suspended.

Coca-Cola said in the same statement that Fairlife’s Canadian operations were not affected. The company said it activated its incident response and business continuity plans, brought in outside cybersecurity advisers and notified law enforcement. It has not said which systems were hit hardest or whether the intrusion reached the equipment that physically runs the bottling lines.

No hacking group has stepped forward to claim credit. That is not unusual this early. Ransomware crews often stay quiet until negotiations stall or they decide public pressure will speed up a payout.

What We Know:

• The filing: Coca-Cola disclosed the breach in a Form 8-K on July 16, 2026.
• What was hit: Hackers accessed a portion of Fairlife’s systems, including production-related systems, in what the company called a ransomware event.
• The shutdown’s reach: All US production is suspended; Canadian plants, including one in Peterborough, Ontario, are running normally.
• Product safety: Coca-Cola says quality and safety have not been affected.

What’s Unconfirmed:

• Who did it: No ransomware group had publicly claimed the attack as of Friday.
• Data theft: Coca-Cola has not said whether customer, employee or supplier data was stolen.
• A ransom demand: The company has not confirmed whether attackers have made an extortion demand.
• A restart date: No timeline has been given for when US production resumes.

A company spokesperson said Friday there was nothing further to add beyond the public filing.

Fairlife Had No Slack Left To Give

Coca-Cola has described Fairlife as a capacity-constrained business for more than a year. Demand for its ultra-filtered milk and Core Power protein shakes has consistently outrun what its plants could bottle, even before a single machine went offline this week.

Sales in the refrigerated white milk category alone grew 28% in 2025, to $782 million, according to Circana data cited by TheStreet. The broader milk category grew just 2% over the same stretch. Coca-Cola and Fairlife have already committed more than $1.3 billion combined to new capacity at two plants that were not finished when the hackers struck.

Coca-Cola chief executive James Quincey addressed the capacity squeeze on an earnings call earlier this year, before the attack.

Obviously, that doesn’t all turn on with a flick of the switch on day one as much as one would wish it would, and that will ramp up over 2026, but it will steadily debottleneck our constraints on capacity across all the different fairlife variants and package sizes.

Fairlife’s popularity has surprised even the company that owns it. Coca-Cola paid $980 million for its original stake in 2020, buying out its joint-venture partner Select Milk Producers, a dairy cooperative. An earn-out tied to sales has since pushed the total price past $7 billion, according to figures Coca-Cola disclosed and CNN reported in February 2025.

“The expectations were never for fairlife to be this successful,” Kaumil Gajrawala, a Jefferies analyst who covers Coca-Cola, told CNN.

Three Plants, Zero Room for Error

Fairlife runs exactly three production plants in the United States, and every one of them has gone quiet. That leaves no domestic backup line to absorb the gap while systems are restored.

Existing inventory in warehouses and on store shelves will keep moving for now, since anything already bottled was made before the breach. A prolonged outage would tighten supply first in regions that lean on Coopersville and Goodyear, since Webster was still building toward full capacity when the shutdown hit.

Who Feels the Shortage First?

A processing freeze at Fairlife does not stay contained to Fairlife. Raw milk still needs somewhere to go every day, grocery shelves still need restocking, and Core Power drinkers still expect their protein fix, all while the company that touches every one of those links stays silent on timing.

• Dairy farmers – the cooperatives that ship raw milk to Fairlife’s plants daily, including the roughly 3,000 dairy farms New York officials cited when the Webster plant broke ground
• Retailers – grocery chains stocking a brand that reaches close to a quarter of US households, according to Nielsen data Coca-Cola has cited
• Protein shake buyers – Core Power drinkers who have few large-scale substitutes on the shelf
• Coca-Cola’s bottling network – the same distribution system that carries Minute Maid and other Coca-Cola brands nationwide

When New York broke ground on the Webster plant, Governor Kathy Hochul framed it as a lifeline for the region’s dairy farms feeding into the largest dairy processing plant in the Northeast. “We have over 3,000 dairy farmers here, and this is a lifeline for them as well,” Hochul said at the time.

That framing cuts both ways now. A processor built around absorbing millions of pounds of local milk a day is exactly the kind of chokepoint where a shutdown ripples backward onto the farms that depend on it, not just forward onto store shelves.

Fairlife’s Supply Chain Has Faced Scrutiny Before

Animal Welfare Complaints Keep Resurfacing

This week’s hack is an IT problem. Fairlife’s supply chain has drawn a different kind of scrutiny for years. An undercover investigation in 2019 exposed animal abuse at a supplying farm, and Fairlife said it cut ties with that operation immediately.

Undercover investigators later found shipments still arriving at the Coopersville plant from related farms in 2023, which Fairlife said involved a single delivery that was never used in products. A 2025 class-action lawsuit alleges the company kept receiving milk from two other flagged dairies and shifted deliveries to nighttime hours to avoid notice, a claim Fairlife disputes.

The Food Industry Is a Favorite Target

Ransomware crews have been circling food and beverage plants for years, and Coca-Cola now joins a list that includes JBS, Dole and Campbell’s Soup. Qilin, a ransomware-as-a-service operation, listed Sysco on its dark web leak site in May, and a separate group claimed responsibility for shutting down two mills at Australia’s Mackay Sugar during peak harvest.

An earlier attack on spirits maker Campari in 2020 halted processing and packing facilities worldwide for roughly eight days. Food and agriculture’s own information-sharing group tracked 265 significant ransomware attacks against the sector in 2025 alone, more than the year before.

Executives in the industry keep making the same mistake, according to Richard Servillas, a security consultant at RSM US. Companies assume nobody would bother targeting a food maker, he has said, and that blind spot is exactly what attackers count on.

Investors Weigh In Before Earnings Hit

Coca-Cola shares slipped 1.1% in after-hours trading Thursday, a muted reaction given how central Fairlife has become to the company’s growth story. The dip lands just days before Coca-Cola’s second-quarter earnings report, when analysts are likely to press executives on how long the outage might run.

In its own filing, Coca-Cola said it has not yet determined whether the incident is reasonably likely to have a material effect on the company. That is standard, cautious language for a breach still under investigation, and it leaves the real financial exposure an open question until the company says more.

By Friday morning, a Coca-Cola spokesperson said there was nothing new to share. The bottling lines in Michigan, Arizona and New York stayed quiet.

Frequently Asked Questions

What is Fairlife’s ultra-filtration process?

Fairlife runs milk through a cold-filtration system that strips out most of the lactose and sugar while concentrating the protein and calcium left behind. The company has marketed this process since its ultra-filtered milk debuted in 2014 as the core difference between its products and standard milk.

Who owns Fairlife, and has it always been Coca-Cola?

Coca-Cola owns Fairlife outright, but that was not always true. Fairlife launched in 2012 as a joint venture between Coca-Cola and Select Milk Producers, a dairy cooperative founded by Mike and Sue McCloskey, before Coca-Cola’s 2020 buyout of the remaining stake.

Is Fairlife sold outside the United States and Canada?

No. Fairlife’s production and distribution are limited to the US and Canada, with its only non-US plant located in Peterborough, Ontario, which sources milk exclusively from Canadian farms and remains unaffected by this week’s shutdown.

Has Fairlife disclosed a cyberattack before this one?

Not that Coca-Cola has made public. This week’s SEC filing is the first disclosure tied to a cyberattack affecting Fairlife’s systems, though the brand has faced separate scrutiny in the past over animal welfare complaints tied to its supplying farms.

Why is Core Power considered hard to replace on shelves?

Core Power holds a large share of the high-protein shake category without a major direct competitor at similar scale, according to industry analysts who track Coca-Cola’s beverage portfolio. That leaves fewer easy substitutes for shoppers if Fairlife’s shutdown drags into weeks rather than days.