A known hacker group is claiming responsibility for a ransomware attack that shut down the U.S. production of Coca-Cola’s dairy brand Fairlife last week.
On a dark-web site not accessible through a standard web browser, a group calling itself Anubis took credit for the attack. Anubis said it locked Fairlife’s servers and threatened to leak 1 terabyte of confidential data unless its demands were met, though it did not post proof it was behind the breach.
The group did not specify a ransom amount in its post, saying only a “token agreement is all it takes” and setting a deadline for the morning of Monday, July 27.
“Be smart and give the people back their milk, damn it! The timer is ticking,” the post states.
Anubis did not post documents or screenshots to prove it is behind the Fairlife attack, which hackers behind other cyberattacks have sometimes done. Anubis has used the website to post alleged leaks related to other companies, such as a New Zealand law firm.
The site where Anubis originally claimed credit was unreachable Thursday morning. Anubis was also claiming the Fairlife attack on a second site it operates.
Ramnath Chellappa, a professor of information systems and operations management at Emory University‘s Goizueta Business School, said the names and composition of ransomware firms can change, and likely only Coca-Cola could verify the legitimacy of the threat.
A Coca-Cola spokesperson declined to comment about the website and said there was no update to share on the status of Fairlife’s operations.
Credit: Screenshot
Credit: Screenshot
In a ransomware attack, criminal groups infiltrate computer systems, make data inaccessible and then demand a ransom, typically requiring payment through a cryptocurrency such as Bitcoin to regain access, said Tyler Moore, head of cyber studies at the University of Tulsa. The hackers may also threaten to disclose private data or trade secrets, he said. Moore provided the web address for the Anubis site, which is accessible using Tor, a browser that anonymizes web traffic.
The Fairlife attack comes months after Coca-Cola brought on a new CEO, Henrique Braun, who has named the company’s digital transformation one of his key priorities. Coca-Cola also added its first chief digital officer this year.
Coca-Cola disclosed the cyberattack July 16, saying it temporarily suspended U.S. production of Fairlife after an unauthorized third party accessed a portion of its systems.
It’s not clear how long the recovery could take.
“It kind of depends on how far it spread before they detected it, and also how sophisticated their response and recovery plans are,” Moore said.
In 2025, a ransomware attack on United Kingdom-based automaker Jaguar Land Rover shut down production for five weeks, costing the British economy an estimated $2.5 billion, according to media reports.
“The full scope, nature and impacts of the incident are not yet known,” Coca-Cola said in a Securities and Exchange Commission filing last week. The company will report its second quarter earnings Tuesday, when executives typically discuss certain issues affecting the company.
Fairlife, which sells filtered milk and protein shakes, is a top brand in Coca-Cola’s portfolio, surpassing $1 billion in annual retail sales in 2022. Fairlife’s growth has coincided with the rise of GLP-1 drugs for weight loss, which has encouraged more people to up their protein intake.
All four of Fairlife’s U.S. manufacturing plants were shut down, according to a report from trade publication Beverage Digest. Coca-Cola previously said operations in Canada are not affected.
Coca-Cola’s U.S. bottlers should have enough Fairlife inventory to withstand a short-term supply chain disruption, but “how much runway bottlers have is unclear,” Beverage Digest reported.
“It’s a very important brand for Coca-Cola, so they’ll want to get this resolved as soon as they can,” said Duane Stanford, editor and publisher of Beverage Digest.
The security breach highlights how manufacturing operations are increasingly vulnerable to attacks, Moore said. “It’s no surprise … you have increasing digitization of the manufacturing process throughout the supply chain,” he said.
Moore added hackers tend to prey on companies that will suffer most. “Any company that would hurt from business disruption is going to be a target, because they will be losing money immediately and will be most tempted to pay the ransom,” he said.
Chellappa, with Emory, said most large firms have contingency plans for cyberattacks, just as they would a physical disaster.
“It all depends on their readiness,” he said.
Coke last week said it notified law enforcement. The Cybersecurity and Infrastructure Security Agency declined to comment. The Federal Bureau of Investigation did not respond to a request for comment.
Coke is just the latest Georgia corporation to be hit by a cyberattack.
This week, Chick-fil-A disclosed “a limited number” of loyalty accounts were hacked in June, exposing personal information.
In August, Atlanta-based software company Salesloft was hit by a hack of its artificial intelligence chat platform. It snowballed into a widespread data theft campaign that ended up potentially affecting at least 700 other companies, including Google Workspace and cybersecurity firms Zscaler and Cloudflare.
That attack came a few months after Columbus-based insurance giant Aflac Inc. suffered a cybersecurity breach that potentially exposed the personal information of nearly 23 million people, including names, health information and Social Security numbers.
Municipalities and state authorities have also been victims of cyberattackers. In June, the city of Acworth disclosed some of its computer systems suffered a breach, although it did not detail how residents may have been affected.
Last fall, the Georgia Superior Court Clerks’ Cooperative Authority, which operates the central database for the state’s real estate index, was the victim of a sophisticated ransomware attack, causing the authority to restrict its website and some services for a few days.
— Reporter Rahul Deshpande contributed to this article.
About the Authors
Keep Reading
The Latest
Featured
