Circuit Wire — a daily news update from the Circuit.
Coca-Cola said on Monday, July 27, that it has resumed the majority of production at its Fairlife dairy plants, eleven days after a ransomware attack forced it to stop work at four US facilities. In the same statement the company confirmed for the first time that the attackers took data.
Coca-Cola disclosed the attack on July 16 in a filing with the Securities and Exchange Commission and halted all US Fairlife production, a shutdown we reported at the time. The company now says it has made significant progress in restoring service at the plants and is still working to bring operations back in full.
"Retail availability of Fairlife products has been largely unimpacted, due to the availability of existing inventory. Product quality and safety have not been impacted," the company said.
The Anubis ransomware group claimed the attack days after the disclosure and added Fairlife to its extortion site, threatening to publish one terabyte of files unless it was paid. The group told BleepingComputer it had encrypted the company's Nutanix systems and left no route to recovery. Coca-Cola reported the intrusion to the authorities and did not follow the attackers' instructions to negotiate. The countdown on the leak site expired on Monday, and the files are now available for download. Coca-Cola declined to comment on the group's claims.
Coca-Cola bought Fairlife from Select Milk Producers in 2020 for roughly $7 billion. The brand produces ultra-filtered milk, protein shakes and nutritional drinks at four plants in the United States, and its annual sales top $3 billion, according to Coca-Cola. The company says it does not expect the incident to meaningfully affect its results.
The attack reached systems that run plant floors rather than back-office functions, which is why output stopped rather than slowed. Coca-Cola's July 16 statement described a technology disruption involving Fairlife operations, and the company said at the time that Canadian operations were unaffected. Production in the United States stayed down for most of the following two weeks.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.