Coca-Cola is investigating a ransomware attack that has forced it to halt U.S. production at its Fairlife dairy business, the company disclosed in a securities filing Thursday. The beverage giant said it is still working to determine the full scope of the breach and what impact it may have on operations.
The attack has not affected the quality or safety of Fairlife products, which include ultra-filtered, lactose-free milk along with protein and nutritional shakes, according to the company. Fairlife’s Canadian operations were not impacted and will remain open.
Coca-Cola acquired its remaining 57% stake in Fairlife in 2020, following a joint venture with Select Milk Producers. The brand has been a growth driver for the company, surpassing $1 billion in annual retail sales starting in 2022.
Production sites and expansion plans hit pause
The company said it has notified law enforcement and is working with cybersecurity experts and other outside advisers to restore systems to normal capacity. It has not commented on who may be behind the attack, and cybersecurity researchers have not yet seen specific claims taking credit for it.
In March, the beverage giant announced a $650 million investment to expand its facilities in Coopersville, Michigan. Fairlife also announced plans in 2023 to open a 745,000 square-foot facility in Webster, New York, which was scheduled to open this year.
It’s unclear how the ransomware attack will affect those timelines.
Related: Welch’s challenges Uncrustables as Campbell’s boosts protein in soups
For a brand that relies on tightly coordinated supply chains for perishable dairy products, a production halt — even a temporary one — can create ripple effects across retail shelves and distribution agreements. The longer systems remain down, the more pressure builds on inventory already in the pipeline.
Agriculture sector under growing cyber threat
This attack is the latest cyber incident to hit the agriculture industry, which has become a more frequent target for hackers in recent years. Officials at the Food and Agriculture Information Sharing and Analysis Center confirmed they are aware of the attack.
The sector has been hit with about 205 attacks so far in 2026, representing roughly 4.9% of all cyberattacks, according to the group.
Scott Algeier, executive director of the Food and Ag-ISAC, said the industry has been pulled into broad, opportunistic hacking.
“The food and agriculture sector has been pulled into the same broad, opportunistic targeting that hits every other sector,” Algeier said. “While some adversaries may be targeting the sector, they scan for exposed, vulnerable systems at machine speed and determine the victim’s details after initial access.”
The agriculture sector was one of several industries impacted by attacks on tank gauges, which are used by energy, chemical and other companies to store fuel and other industrial liquids. The beverage giant did not say whether its own tank systems were affected in this incident.