Coca-Cola Halted Its $6 Billion Fairlife Milk Brand After a Ransomware Attack. Food Manufacturing's Cyber Reckoning Has Arrived

Coca-Cola paid a $6.1bn earnout for Fairlife in early 2025. Eighteen months later, a ransomware crew switched the brand's entire US production off in a single afternoon.

On 16 July, Coca-Cola said it found unauthorised access to part of its network, including the systems that run Fairlife's plants. It suspended US production while it investigates. Canada is still running. The company says product quality and safety are fine, that it has brought in outside cyber experts, and that it has told law enforcement. It also said the full scope of the attack is not yet known.

No ransomware group has claimed the hit. Coca-Cola has not said whether data was stolen or whether it is being asked to pay. The point for the rest of the industry is simpler: an attacker reached the factory floor, and the factory stopped.

Why Fairlife is a bad brand to lose

Fairlife is no side project. It makes ultra-filtered milk, the Yup flavoured range, and Core Power protein shakes. It is one of Coca-Cola's fastest-growing brands and passed $1bn in annual retail sales years ago. Protein is the hottest thing in the chiller right now, and Fairlife sits in the middle of it.

Coca-Cola knows what it is worth. It took full ownership in 2020, then paid that $6.1bn earnout in early 2025 as sales flew past the targets. In March 2026 it committed another $650m to add production lines at its Coopersville plant in Michigan, with a new site in New York state due to start this year. A company does not spend like that on a brand it can afford to leave offline.

The factory floor is the new target

For years, cyber risk in food meant stolen email and leaked customer data. That has changed. Attackers now go after the operational systems that run the machines, because a stopped plant creates the most pressure to pay fast.

We have seen this before. In 2021, a ransomware attack shut JBS meat plants across the US, Canada and Australia, and the meat giant paid an $11m ransom to get moving again. A Japanese food group was hit by a separate cyberattack the same week as Fairlife. Each of these hits followed the same logic: stop the line, and the clock starts working for the attacker. Food and drink makers have become prime targets, because their plants are perishable and hard to run by hand.

The ransom is the small number

The cheque to the hackers is rarely the real cost. The damage is the lost output and the empty shelves it leaves behind, as shoppers grab a rival tub because the usual one is missing.

Fairlife is chilled and dated, so lost days cannot be clawed back later the way a can of soda can. In a category growing this fast, a two-week gap on shelf is an open invitation for every protein rival to take the space. The longer the US lines stay down, the more that hidden cost climbs past anything a ransom would have been.

What buyers and boards should take from this

Three things change after an attack like this one. Cyber stops being an IT line item and becomes a board-level operational risk, sitting next to supply and commodity cost. Buyers and private equity start pricing plant security into deals, because a target with weak factory systems carries a hidden liability. And resilience spending, from backup capacity to tested recovery plans, starts to look like normal capex.

Coca-Cola will get Fairlife back. It has the cash and the expertise to recover. The lasting lesson is that the most valuable brand in your portfolio is only as strong as the software running its production line. The companies that treat that as a strategic exposure will be the ones still shipping when the next attack lands.