The Coca-Cola Company on July 16th filed a regulatory disclosure and public statement announcing a significant cybersecurity incident affecting its wholly-owned dairy subsidiary, fairlife, LLC. The incident involved unauthorized third-party access to fairlife’s information technology (IT) and production-related systems due to a ransomware attack.

Upon detection, fairlife activated its corporate incident response and business continuity protocols, engaged external incident response and forensic advisors, and notified federal law enforcement agencies as per its IR plan. While product quality, safety, and food safety monitoring systems were not compromised, the cyberattack forced fairlife to temporarily suspend milk processing and manufacturing operations across its United States production facilities. Operations at fairlife’s Canadian facility remained unimpacted and operational.

On July 20–21, 2026, the emerging threat group Anubis ransomware listed fairlife on its dark web data leak site, claiming credit for the intrusion and exfiltration of corporate data.

Initial severity assessment

• Severity rating: CRITICAL (Operational Threat)

• Impact scope: High operational disruption in U.S. processing units; moderate financial exposure; zero immediate impact on product safety or consumer health.

• Manufacturing and OT relevance: This incident demonstrates the operational risk posed by ransomware to the Consumer Packaged Goods (CPG) and Food and Agriculture sectors. Even when plant-floor industrial control systems (ICS) are not directly encrypted, loss of supporting IT systems—such as Manufacturing Execution Systems (MES), enterprise resource planning (ERP) platforms, or quality assurance databases—can force precautionary operational shutdowns.

Incident timeline

• Pre-July 16, 2026 (Unconfirmed Window): Initial compromise of fairlife’s environment, lateral movement, credential harvesting, and potential data exfiltration occur.

• July 16, 2026 (Detection & Isolation): fairlife security operations identify unauthorized access across IT and production-related systems. Incident response protocols are triggered. Production at all U.S. manufacturing facilities is suspended as a containment measure.

• July 16, 2026 (Public Disclosure): The Coca-Cola Company releases an official press statement and SEC regulatory filing detailing the technology disruption and operational pause. Law enforcement and third-party forensic firms are formally retained.

• July 17–19, 2026 (Investigation & Scoping): Forensic teams conduct forensic scoping, Active Directory auditing, and system isolation. Canadian facilities are confirmed isolated and operational.

• July 20–21, 2026 (Ransomware Claim): The Anubis ransomware group lists fairlife on its TOR-based double-extortion leak platform. Cyber Daily and dark web tracking services report the claim.

Technical incident analysis

Because forensic investigations by Coca-Cola and retained incident response providers remain ongoing, detailed technical artifacts have not been officially published. The following analysis synthesizes confirmed facts with reasonable technical inferences based on established threat intelligence patterns.

Initial access

• Confirmed facts: External third-party actors established unauthorized access to a portion of fairlife’s network.

• Technical inference: Threat actors operating ransomware campaigns in 2026 primarily obtain initial access through three vectors:

  1. Exploitation of edge devices (e.g., VPN concentrators, perimeter firewalls, virtual desktop infrastructure).

  2. Stolen credentials purchased from initial access brokers (IABs) via infostealer logs.

  3. Phishing campaigns leveraging malicious attachments or spear-phishing links.

Privilege escalation and lateral movement

• Confirmed facts: The adversary moved beyond entry points to impact systems supporting production operations.

• Technical inference: The threat actor likely conducted internal reconnaissance via standard Living-off-the-Land (LotL) binaries (e.g., net.exe, nltest.exe, PowerShell, WMI) to map domain trusts and identify server subnets hosting business and operational assets.

Production system impact

• Confirmed Facts: fairlife suspended U.S. manufacturing operations. Product quality and safety monitoring were not compromised.

• Technical Inference: Plant-floor Programmable Logic Controllers (PLCs) and Human-Machine Interfaces (HMIs) were likely not directly encrypted or modified. Instead, production was halted due to the unavailability of Level 3/3.5 IT-dependent systems (e.g., Manufacturing Execution Systems, raw material batching software, automated logistics, or enterprise resource planning platforms) or as a safety measure to prevent lateral propagation.

Data exfiltration and ransomware deployment

• Confirmed facts: The incident was identified as a ransomware event. Anubis listed fairlife as a victim on its data leak site.

• Technical inference: Anubis follows a double-extortion model. Prior to deploying file-encrypting payloads in the enterprise IT environment, the threat actor exfiltrated sensitive files via automated command-and-control (C2) utilities or cloud storage tools (such as Rclone, MEGAsync).

OT security analysis

Understanding how a cyber incident at a dairy processor causes operational downtime requires analyzing the interdependencies between IT, Industrial DMZs, and Operational Technology (OT).

Direct OT compromise vs. precautionary operational shutdown

A central question in manufacturing incidents is whether the threat actor actively compromised Level 1/2 control devices (PLCs, SCADA) or if operations were shut down due to loss of supporting IT systems.

• Direct OT compromise (Low Probability): There is no evidence indicating that Anubis or associated actors deployed specialized ICS malware (e.g., PIPEDREAM, INDUSTROYER) or wiped field controller firmware.

• IT-to-OT interdependency disruption (High Probability): Modern dairy plants rely heavily on Level 3 systems:

  1. Manufacturing Execution Systems (MES): Track work orders, ingredient volumes, and recipe schedules. If MES servers are encrypted or disconnected, automated filling lines cannot receive job definitions.

  2. Recipe and Batch Management Systems: Ensure ultra-filtering, pasteurization, and protein blending meet regulatory specifications. Loss of recipe management prevents automated line startup.

  3. Quality Assurance (QA) and traceability: Federal food safety regulations mandate real-time tracking of pasteurization temperature logs. If historians or QA databases are inaccessible, regulatory compliance prohibits operating lines.

• Proactive isolation (High Probability): Severing corporate-to-plant network connections to prevent ransomware from propagating into Level 2/3 plant-floor networks often requires taking automated systems offline manually.

Purdue model and architectural implications

Level 4/5 (Enterprise IT)

Primary zone of compromise. Active Directory, file servers, and administrative workstations were likely isolated, unavailable, or otherwise affected as part of containment or ransomware activity.

Level 3.5 (Industrial DMZ)

The effectiveness of the IDMZ determines whether an attack stops at corporate IT. Jump hosts, patch servers, and centralized Active Directory domain controllers placed in the IDMZ often serve as conduits if dual-homed or improperly segmented.

Level 3 (Site Operations)

Contains MES, local Historians, and batching servers. If Level 3 shares Active Directory authentication with Enterprise IT (Level 4), compromised corporate credentials allow lateral movement directly into plant operations.

Level 0–2 (Control & Physical Process)

PLCs, Variable Frequency Drives (VFDs), and Safety Instrumented Systems (SIS) remained physically intact. Food safety controls (e.g., high-temperature short-time pasteurization safety cutoffs) operate independently of enterprise networks.

Cross-Border Segmentation

A key operational insight from this incident is that fairlife’s Canadian operations were not impacted and remained running. The continued operation of Canadian facilities strongly suggests that architectural, organizational, or network-level separation effectively limited the operational blast radius. However, the specific segmentation mechanisms have not been publicly disclosed. Separate Active Directory forests, isolated VPN infrastructure, or distinct enterprise tenant structures between U.S. and Canadian operations successfully contained the blast radius.

MITRE ATT&CK mapping

MITRE ATT&CK for enterprise

MITRE ATT&CK for ICS

At the time of conducting this analysis, there was no evidence of Modify Controller Tasking or Program Download or Controller Firmware or Loss of View

Indicators of Compromise (IOCs)

Official Status Notice: As of the publication of this report, no publicly verified indicators of compromise (IOCs) including file hashes, C2 IP addresses, domains, or specific registry keys—have been released by The Coca-Cola Company, fairlife, law enforcement agencies, or investigating cybersecurity vendors.

When verified IOCs are published, this section will be updated. Organizations should focus on behavior-based detection rules outlined in subsequent sections.

Anubis ransomware analysis

Group background and evolution

Anubis ransomware is an emerging Ransomware-as-a-Service (RaaS) platform operating under a double-extortion business model. The group targets mid-to-large-scale commercial enterprises, critical infrastructure providers, and manufacturing organizations.

Typical TTPs (General Anubis Profiles vs. Incident Observations)

Initial access

• General Anubis Profile: Leverages stolen credentials (infostealers), unpatched vulnerabilities in remote access solutions (Fortinet, Citrix, Ivanti), or compromised RDP endpoints exposed to the internet.

• Observed in Incident: Specific initial entry mechanism remains unconfirmed by fairlife.

·      Discovery and defense evasion

• General Anubis Profile: Disables security software (EDR/AV) using kernel-level driver vulnerabilities (BYOVD - Bring Your Own Vulnerable Driver) or compromised administrative tooling. Clears Windows Event Logs (wevtutil cl).

• Observed in Incident: Blended access that avoided immediate detection until encryption staging triggered response protocols.

Data exfiltration

• General Anubis Profile: Uses command-line archive tools (7-Zip, WinRAR) combined with Rclone or MEGAsync to exfiltrate files to cloud infrastructure prior to encryption.

• Observed in Incident: Anubis claimed fairlife as a victim on its leak site on July 20–21, 2026, indicating data exfiltration likely occurred prior to system isolation.

Encryption

• General Anubis Profile: Deploys custom C/C++ compiled binaries that terminate database services (SQL, Exchange), hypervisors (ESXi, Hyper-V), and volume shadow copy services (vssadmin delete shadows /all /quiet). Appends a specific extension to encrypted files and drops a RECOVER-FILES.txtransom note.

• Observed in Incident: Extent of file-level encryption on production-related systems remains undisclosed.

Manufacturing lessons learned

Architectural Independence of Level 3 Systems

Manufacturing facilities often stop production during IT incidents because plant systems depend directly on corporate Active Directory, DNS, and licensing servers. Organizations must decouple Level 3 MES and SCADA infrastructure from Level 4 enterprise IT, enabling plant operations to run in "island mode" for extended periods during corporate network outages.

Identity Disambiguation Across IT and OT

Using a unified Active Directory forest across corporate environments and plant networks creates a single point of failure. If an adversary gains Domain Admin privileges in IT, they automatically acquire domain authority over plant-floor HMIs and historian servers. Plant-floor Active Directory structures should be isolated into independent, untrusted forests or managed via local identity providers with mandatory MFA on all jump hosts.

Business continuity and manual fallback planning

In highly automated food and beverage facilities (such as high-speed bottling and filtration plants), manual operation can be difficult. However, plants should maintain documented, regularly exercised manual fallback procedures for critical sub-processes (e.g., manual temperature logging, offline batch tracking) to maintain emergency operational capacity.

Supply chain risk and vendor access

Industrial environments frequently utilize remote vendor access for specialized processing equipment (e.g., homogenizers, pasteurizers, automated packaging lines). Unmonitored vendor connections bypass traditional IT security perimeters. Strict Zero Trust Network Access (ZTNA) with session recording and time-based access controls must be enforced for all external engineering support.

Detection opportunities

Security Operations Centers (SOCs) and OT monitoring teams can implement the following behavior-based detection rules to identify similar threat patterns:

1. Active Directory and Privilege Abuse

// Query: Detect Lateral Movement via RDP/SMB across IT-OT DMZ Boundaries

DeviceNetworkEvents

| where RemotePort in (3389, 445)

| where LocalDeviceName has_any ("IDMZ-JUMP", "MES-SRV", "HISTORIAN")

| where InitiatingProcessFileName in~ ("mstsc.exe", "psexec.exe", "powershell.exe")

| summarize Count=count() by InitiatingProcessAccountName, RemoteIP, LocalDeviceName

| where Count > 5

2. Volume Shadow Copy Deletion & BCD Modification

// Query: Detect Common Ransomware Inhibiting System Recovery

DeviceProcessEvents

| where ProcessCommandLine has_any (

    "vssadmin delete shadows",

    "wmic shadowcopy delete",

    "bcdedit /set {default} bootstatuspolicy ignoreallfailures",

    "bcdedit /set {default} recoveryenabled no"

)

| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FolderPath

3. Anomalous Exfiltration via Command-Line Utilities

// Query: Detect Unauthorised Archiving or Cloud Exfiltration Execution

DeviceProcessEvents

| where ProcessFileName in~ ("rclone.exe", "7z.exe", "megasync.exe", "winrar.exe")

| where ProcessCommandLine has_any ("--config", "copy", "sync", "a -hp", "upload")

| project Timestamp, DeviceName, AccountName, ProcessCommandLine

4. Industrial Network Anomaly Detection

• Unusual Administrative Traffic: Monitor for unexpected SMB/RDP connections originating from Level 4 enterprise IP ranges attempting to connect directly to Level 2 HMI subnet addresses, bypassing IDMZ jump servers.

• Mass File Renaming: Monitor local file systems on MES and Historian servers for high-frequency file modification, renaming, or unknown file extension generation.

Strategic analysis

Implications for the Food and Agriculture sector

The cyberattack on fairlife highlights the vulnerability of the Food and Agriculture sector which is a critical infrastructure segment characterized by low margin tolerance, tight delivery timelines, and continuous processing requirements.

Food manufacturing differs from automotive. Perishability changes ransomware economics as milk comes with a shelf life. Once collection tanks are full, the plant has to stop.

• Perishable supply chains: Unlike general discrete manufacturing, dairy and food processing hancle highly perishable raw materials. Production halts can force the disposal of unprocessed raw milk and cause supply bottlenecks across retail networks.

• Regulatory compliance dependencies: Food processing facilities operate under strict regulatory standards (e.g., FDA, USDA) regarding pasteurization times, sanitation, and temperature tracking. Loss of digital logging systems forces operational pauses due to compliance requirements, even when mechanical systems remain functional.

• Targeting trends: Threat actors recognize that manufacturing organizations face significant downtime costs, increasing the perceived leverage for ransom demands.

Shieldworkz recommendations

For CISOs & Executive Security Leaders

• Enforce Complete Separation of IT and OT Identity Infrastructure: Audit Active Directory architecture to ensure compromise of corporate IT credentials cannot grant access to Level 3 MES or Level 2 SCADA networks.

• Review SEC Disclosure & Cyber Incident Playbooks: Ensure corporate legal, communications, and technical teams have rehearsed material incident reporting protocols under SEC rules.

For OT Security Teams and Plant Engineers

• Conduct Island-Mode Operational Tests: Test the ability of individual manufacturing plants to maintain basic operations if enterprise WAN connections and corporate IT services are cut off.

• Implement strict IDMZ Architecture: Verify that all communications between Level 4 (IT) and Level 3 (OT) pass through a hardened Industrial DMZ with no direct dual-homed network routes.

• Backup & Verify Offline Recipe & PLC Configurations: Maintain air-gapped, encrypted, and regularly tested backups of all PLC logic programs, HMI software images, and MES recipe databases.

For Incident Response and SOC Teams

• Deploy Behavior-Based EDR on Level 3 Systems: Ensure EDR solutions capable of detecting LotL techniques, shadow copy deletion, and credential dumping are installed on all Windows/Linux assets in the IDMZ and Level 3 networks.

• Establish Pre-Authorized OT Incident Protocols: Establish explicit protocols defining who has the authority to disconnect plant networks during an ongoing cyber incident to balance threat containment against production downtime risks.

Outstanding unknowns

Confidence assessment

• Ransomware Incident and Production Suspension (High Confidence): Directly confirmed by official regulatory filings (SEC Form 8-K) and corporate press releases issued by The Coca-Cola Company on July 16, 2026.

• Product Quality and Safety Integrity (High Confidence): Confirmed by corporate statements verifying that safety monitoring and food quality controls operated normally throughout the event.

• Attribution to Anubis Ransomware (Medium Confidence): Based on dark web listings published on July 20–21, 2026. While dark web claims are generally reliable indicators of involvement, official forensic confirmation from Coca-Cola or law enforcement remains pending.

• IT-to-OT Disruption Mechanism (High Confidence): Based on the preservation of product safety systems alongside the pause in automated production, pointing to Level 3 IT-dependency disruption rather than physical control-layer destruction.

Manufacturing organizations should expect ransomware groups to increasingly target production-support systems (rather than attempting direct compromise of industrial controllers). Disrupting MES, identity services, quality systems, and enterprise logistics often achieves the same operational outcome while requiring far less specialized knowledge of industrial control systems.