Coca-Cola’s Fairlife dairy brand stopped all U.S. production this week after a ransomware attack disabled its systems. The company revealed the breach in an SEC filing.
Fairlife’s U.S. plants go dark amid ransomware attack
The attack targeted Fairlife’s operational technology, preventing the company from processing or shipping products. Coca-Cola stated it is collaborating with law enforcement and cybersecurity experts to evaluate the damage and restore operations, though the full extent of the breach remains unknown. Canadian facilities continued to operate normally.
The brand, recognized for its ultra-filtered milk and protein shakes, has been a key growth area for Coca-Cola. Coca-Cola announced a $650 million investment to expand its Coopersville, Michigan, facility months ago, and a 745,000-square-foot plant in Webster, New York, was scheduled to open this year. Both projects may now face delays.
Scott Algeier, who leads the Food and Agriculture Information Sharing and Analysis Center, confirmed the attack. He noted the sector experienced about 205 ransomware incidents in 2026, accounting for 4.9% of all such attacks across industries. Algeier explained that attackers scan for exposed systems rapidly and identify victims afterward. The food and agriculture sector has become part of the same broad targeting that affects other industries.
Most food manufacturers depend on connected operational technology, and many have expanded or acquired new infrastructure in recent years. The Fairlife incident demonstrates that no company is fully protected, regardless of its size or investments.
Related: Kraft Heinz reshapes operations to boost growth
The filing did not indicate whether the attackers demanded payment or if Coca-Cola complied. The event follows a trend of ransomware groups targeting critical infrastructure, where downtime directly impacts revenue.
Lettuce recall expands as Cyclospora cases exceed 1,600
A Cyclospora outbreak tied to shredded iceberg lettuce from Taylor Farms de Mexico has sickened 1,644 people and hospitalized 94 across five states, the CDC reported. Investigators linked the contamination to lettuce served at Taco Bell locations in Indiana, Kentucky, Michigan, Ohio, and West Virginia.
Taylor Farms voluntarily removed all iceberg lettuce sourced from central Mexico from the U.S. market. The recall now includes Marketside-brand product sold at Walmart. The CDC instructed retailers to discard any remaining affected inventory.
The International Fresh Produce Association criticized the slow traceback process, calling it a breakdown in end-to-end traceability. Max Teplitski, the association’s chief science officer, stated the situation shows why the FDA’s Food Traceability Rule must move forward. The rule is coming before year-end, though a binding final rule is unlikely before 2028 at the earliest. Congress has delayed implementation multiple times.
Teplitski emphasized that supply chains and regulators need to build this infrastructure before outbreaks occur, rather than reacting during a crisis. Food traceability flaws have become increasingly visible as recalls grow more frequent.
FDA revokes one color additive, considers GRAS changes
The FDA revoked authorization for Orange B, a petroleum-based color additive, and proposed eliminating Citrus Red No. 2, which has been used since 1959 to dye orange skins. The agency stated both additives have been largely discontinued by industry. Public comments on Citrus Red No. 2 will be accepted through August 24, 2026.
A more significant change for manufacturers is the FDA’s plan to publish a proposed mandatory GRAS notification rule by the end of the year. The rule, labeled “economically significant,” would require companies to submit notifications for food substances currently considered Generally Recognized as Safe. Self-affirmed GRAS determinations would no longer be legally sufficient under the new requirements.
The agency’s 2026 Unified Regulatory Agenda confirms the rulemaking, though legal challenges are expected. A binding final rule is unlikely before 2028 at the earliest.
The Fairlife attack and the Cyclospora outbreak reveal weaknesses in food supply chains—one digital, one physical. Neither came as a surprise, yet both exposed gaps that regulators and companies have not addressed. The FDA’s regulatory push on additives and GRAS may drive changes, but the timeline remains unclear.