Coca-Cola pauses Fairlife production in the U.S. after ransomware intrusion, while Canada continues

Coca-Cola is pausing U.S. production of Fairlife products after a ransomware attack, according to a report published July 17. The company said the incident involved an unauthorized third party gaining access to Fairlife production-related systems.

Fairlife is the Coca-Cola-backed dairy brand known for products sold as milk, protein shakes, and related beverages. For Coca-Cola, Fairlife is a key consumer offering in the fast-growing dairy and alternative nutrition categories, where consistent manufacturing and supply are central to retailer relationships.

In the company’s account summarized by the report, the ransomware event triggered operational changes intended to contain the intrusion and reduce the risk of continued disruption. The report states that the U.S. halt covers production while the issue is being addressed.

Coca-Cola also said the ransomware attack did not affect its Canadian operations. In practice, that means the company’s manufacturing footprint north of the border continued, at least for the time period described, while U.S. production remained suspended.

The report attributes the disruption to the scope of systems accessed, specifically those tied to Fairlife production. That distinction matters because production-related access can complicate both physical manufacturing processes and operational controls, even when customer-facing systems are unaffected.

A ransomware attack generally refers to malicious software that locks or encrypts data and systems, often accompanied by attempts to exfiltrate information or demand payment. Even when payment is not paid, companies typically respond by isolating affected networks and pausing certain operations until investigators determine whether systems have been compromised beyond what is already known.

What Coca-Cola did not disclose in the July 17 report includes the full duration of the U.S. production pause, whether any products were recalled, what specific systems were accessed beyond “production-related systems,” and whether any data involving employees, vendors, or consumers was exposed. The company also did not provide, in the report summary, a timeline for resuming output or additional mitigation steps.

For the market, the near-term focus will be on when U.S. Fairlife production can restart without compromising safety or quality controls. Retailers that depend on regular replenishment may watch for inventory adjustments, while competitors in refrigerated dairy and protein beverages may look for temporary shelf-space opportunities. The situation also underscores how operational technology, not just IT systems, has become a growing target in ransomware campaigns.