Coca-Cola on Monday said production has mostly resumed at its Fairlife dairy facilities in the U.S. following a ransomware attack earlier this month.
The company previously suspended operations at Fairlife after hackers gained access to certain systems and stole data. Fairlife is a maker of ultra-filtered, lactose-free milk, as well as protein and nutritional shakes.
Limited timeline
A ransomware-as-a-service group called Anubis took credit for the attack. The hackers claimed to have locked Fairlife’s servers and stole up to 1TB of data, according to researchers at Arctic Wolf. Anubis threatened to leak information if its demands were not met, but details of the extortion demand were not disclosed.
Anubis previously gained entry to targeted sites through the use of stolen credentials or by exploiting critical vulnerabilities, including CitrixBleed2, tracked as CVE-2025-5777, Arctic Wolf said.
Anubis operates using three affiliate models, according to researchers at Sophos. The group engages in traditional ransomware-as-a-service as well as data-theft-only extortion and access monetization.
Coca-Cola, while acknowledging the attack was linked to ransomware, did not comment on how it was able to restore production. The company also did not provide any details about how the hackers gained access to the Fairlife systems.
Coca-Cola said retail access to Fairlife’s milk products largely were not an issue, due to the wide availability of existing inventory. The company said Fairlife’s Canadian business was not impacted at all.
The company does not believe the attack will have a material impact on its financial condition or results of operations. Fairlife is a large business for Coca-Cola, surpassing $1 billion in annual revenue starting in 2022. The dairy unit has four locations in the U.S.
Earlier this year, Coca-Cola announced a $650 million investment to expand the size of its Coopersville, Mich., facility. The company is also set to open a 745,000 square-foot facility in Webster, N.Y.
The beverage giant said it is still working to fully restore all impacted systems and operations.
