Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack
Coca-Cola’s Fairlife subsidiary suffered a ransomware attack from the Anubis group, resulting in a data breach and the potential release of 1TB of stolen data. Production has largely resumed, but the group is threatening to publish the data unless a ransom is paid. The incident highlights the growing risk of extortion attacks targeting food and beverage companies.
Coca-Cola confirmed on Monday that a recent ransomware attack on its Fairlife dairy products subsidiary had led to a data breach. The attack, attributed to the Anubis ransomware group, prompted the company to suspend production at four Fairlife facilities in the United States as it investigated and responded to the intrusion. The Anubis group listed Coca-Cola and Fairlife on its leak website on July 20, claiming to have stolen 1TB of confidential data and threatening to publish it within two hours unless a ransom is paid.
Coca-Cola stated that retail availability of Fairlife products has largely remained unaffected due to existing inventory levels, and that product quality and safety have not been compromised. The company added that it believes the incident has not materially impacted its financial condition or operational results.
The Anubis ransomware group, active since December 2024, employs a double-extortion model, encrypting files on compromised systems while simultaneously exfiltrating data to increase its chances of receiving a ransom payment. They are known for a ‘wiper mode’ feature, which allows them to permanently delete files and prevent recovery.
This incident underscores the increasing threat of ransomware attacks against food and beverage companies, a sector often targeted due to the sensitive data they handle. The potential exposure of confidential information could have significant reputational and financial consequences for Coca-Cola.