Fairlife’s Ransomware Shutdown Follows the Same Script as JBS and Dole

Coca-Cola’s Fairlife dairy brand shut down all its US milk production this week after hackers broke into the company’s systems in a ransomware attack, the beverage giant disclosed Thursday. Product quality is not affected, Coca-Cola said, and Fairlife’s Canadian plants are running as normal.

That statement drops Fairlife into a pattern the food and beverage industry knows well. JBS, Schreiber Foods and Dole all shut down production after ransomware hits in the past five years, and each time, the early corporate language about a temporary disruption gave way to weeks of cleanup, a costly ransom decision, or both. Coca-Cola has poured close to a billion dollars into owning Fairlife outright, with a final price tag that could balloon far higher, and that bet is now caught in an active cybersecurity investigation with no timeline attached.

Fairlife’s US Lines Go Dark After a Ransomware Hit

Coca-Cola told the Securities and Exchange Commission in a July 16 filing that fairlife, the wholly owned dairy subsidiary it runs out of Chicago, had identified unauthorized access to a portion of its systems, including systems tied to production. The company said the intrusion was connected to a ransomware event and that it had taken some operations offline in response.

Coca-Cola said it activated its incident response and business continuity protocols as soon as it detected the intrusion. Its investigation, done with outside advisors and cybersecurity experts, is ongoing, and law enforcement has been notified. “The full scope, nature and impacts of the incident are not yet known,” Coca-Cola said.

What the company did confirm: production at fairlife’s US plants is temporarily suspended, and Canadian operations are unaffected. A spokesperson said Friday there were no further updates to share. No ransomware group had publicly claimed responsibility for the attack as of this week, and Coca-Cola has not said whether hackers stole data or made a ransom demand.

JBS, Schreiber Foods and Dole Wrote This Playbook First

Fairlife is not the first dairy or food company to lose its production floor to hackers, and the industry’s track record suggests corporate reassurances tend to age poorly. Three cases stand out.

In May 2021, JBS Foods, the world’s largest meat producer, had its US, Canadian and Australian plants knocked offline by the REvil ransomware group. The shutdown idled roughly a fifth of America’s beef and pork slaughtering capacity. JBS ended up paying an $11 million ransom in Bitcoin to restart its systems, a decision that drew criticism from lawmakers worried about encouraging copycat attacks. Claroty, a cybersecurity research firm that studied the incident, said the attack forced the closure of five meat plants for three days. Researchers have often compared that case to the Colonial Pipeline hack the same month, when the pipeline operator paid close to $5 million for a decryption key.

Five months later, Schreiber Foods, a major cheese and dairy processor, had its own milk processing plants and distribution centers shut down by ransomware, disrupting milk transportation routes and locking employees out of company buildings. Then in February 2023, Dole was hit with an attack that shut down North American production plants, exposed the records of roughly 3,900 US employees, and left grocery stores in Texas and New Mexico without Dole salad kits for days. The company later put the cost at around $10.5 million.

Each of those cases opened with a confident company statement, then stretched into a longer investigation than first suggested. That is the history Fairlife now sits alongside, whether or not this attack follows the same arc.

Why Milk Plants and Meatpackers Keep Losing to Hackers

Food and beverage manufacturing keeps showing up on ransomware target lists for reasons that have little to do with the industry improving its defenses.

• Old equipment, new exposure. Much of the industry runs on operational technology built decades before anyone connected a bottling line to the internet, and retrofitting security onto that equipment is slow and expensive.
• No room for downtime. Dairy and meat plants run around the clock on perishable inputs, so every hour offline pushes harder toward paying a ransom just to restart the line.
• Tightly linked supply chains. A single plant shutdown can ripple to distributors and store shelves within days, as Dole’s customers found out in 2023.
• Critical infrastructure status. The federal government classifies food and agriculture as one of 16 critical infrastructure sectors, covering roughly 2.1 million farms and more than 200,000 production and processing facilities, a footprint too big to patch all at once.

Security researchers who track these attacks say the industry isn’t necessarily being singled out. Analysts at Dragos, an industrial cybersecurity firm, have said ransomware crews are largely opportunistic, hitting whichever networks they can break into rather than choosing food companies on purpose. That distinction offers little comfort to a plant that stays idle.

The cyber risk and national security threat to farms, ranches, and food processing facilities is growing exponentially.

FBI Special Agent Gene Kowel said that at a recent bureau symposium on threats to the agriculture and food sector.

A $7.4 Billion Bet Hits Turbulence

Coca-Cola didn’t build Fairlife. It bought it. The company took a minority stake in the dairy brand in 2012, then paid roughly $980 million in January 2020 to buy out joint venture partner Select Milk Producers and take full control, a deal detailed in the remaining 57.5% stake acquisition filing Coca-Cola submitted that year.

The bet paid off. Fairlife now brings in more than $3 billion a year in retail sales. Performance-based earn-out payments tied to that growth could push Coca-Cola’s total outlay toward $7.4 billion over five years, which would make it the largest brand purchase in the company’s 133-year history. Coca-Cola’s stock slipped 1.1% in extended trading the day the attack became public.

Fairlife’s production is lean and concentrated, which helped make it a strong bet. That same setup cuts the other way during an outage: the brand runs through a small number of dedicated US plants, leaving little spare capacity to absorb the shutdown if systems stay down for long.

Is Fairlife Milk Still Safe to Buy?

Yes, according to Coca-Cola. The ransomware attack hit production and IT systems, not the products themselves, and the company has repeatedly said quality and safety have not been impacted by the intrusion or the shutdown that followed it. That statement covers existing inventory and any output made before systems were taken offline. What it does not resolve is how long new production stays paused, or exactly what the attackers accessed before Coca-Cola cut off their access.

What we know:

• Production systems were breached in a ransomware event, confirmed in Coca-Cola’s July 16 SEC filing.
• Product quality and safety have not been affected, Coca-Cola says.
• Canadian production is unaffected; only US lines are suspended.

What’s unconfirmed:

• Whether hackers stole customer, employee or supplier data.
• Which ransomware group carried out the attack; none has claimed responsibility.
• How long US production will stay offline, and whether a ransom has been demanded.

Frequently Asked Questions

Has any ransomware gang claimed responsibility for the Fairlife attack?

No group had publicly claimed the attack as of this week. Outlets that track ransomware leak sites reported that Coca-Cola has not said whether data was stolen or whether a ransom demand was made. If attackers did take files, groups typically post proof to extortion sites once negotiations stall, and that hasn’t happened yet.

Will Fairlife products run short at grocery stores?

Coca-Cola has not said how long the disruption will last or whether customer shipments will be affected. Canadian production continues without interruption, and US inventory made before the shutdown remains in the supply chain, but the company has given no restart timeline for American lines.

What is Fairlife’s ultra-filtered milk, and how is it made?

Fairlife runs cow’s milk through an ultra-filtration process that strains out much of the sugar and lactose while concentrating the protein, producing a lactose-free product with roughly double the protein of regular milk. The brand built its business on that process before expanding into Core Power protein shakes and other nutrition drinks.

How much has ransomware cost the US food industry overall?

Researchers tracking food, beverage and agriculture attacks counted 157 confirmed ransomware incidents between 2018 and May 2023, with 2021 the worst single year at 64 attacks. Those incidents cost an estimated $1.36 billion in downtime alone, and hackers have demanded as much as $15 million in a single attack on a food company.

Does Coca-Cola fully own and control Fairlife’s operations?

Yes. Coca-Cola has owned 100% of fairlife since closing its buyout of Select Milk Producers’ stake in January 2020, though the brand continues to operate as a standalone business based in Chicago. Coca-Cola does not break out fairlife’s finances separately in earnings reports, so investors are likely to press for detail on this disruption’s cost when the company next reports quarterly results.