Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack

The soft drinks giant confirmed on Monday that the recent ransomware attack on its dairy subsidiary Fairlife escalated into a full-blown data breach. Coca-Cola disclosed the cybersecurity incident on July 16, when it suspended production at Fairlife facilities across the United States while investigating the intrusion.

Now, the Anubis ransomware group has claimed responsibility and is threatening to leak stolen data. Here’s what we know so far.

What Happened: Fairlife Production Halted, Then Resumed

Coca-Cola initially announced the cyberattack on July 16, halting operations at four Fairlife facilities in the US. The company said it was working with law enforcement and cybersecurity experts to contain the threat.

By Monday, a statement from Coca-Cola confirmed that “a majority of production has been resumed” at those facilities. The company also acknowledged that the incident involved the “taking of certain data,” though it declined to share further details.

“Retail availability of Fairlife products has been largely unimpacted, due to the availability of existing inventory,” the statement read. “Product quality and safety have not been impacted.”

Anubis Ransomware Group Takes Credit, Threatens Leak

The Anubis ransomware group listed Coca-Cola and Fairlife on its leak website on July 20, claiming to have encrypted files and stolen 1 TB of confidential data. A timer on the site indicated that the stolen data would be made public within hours unless a ransom was paid.

It’s unclear exactly what type of data was compromised, but extortion gangs often exaggerate the importance of stolen files to pressure victims into paying. This is a common tactic in double-extortion schemes.

Who Is the Anubis Ransomware Group?

Active since December 2024, Anubis has listed roughly 100 targeted organizations on its website. The group uses a double-extortion model: encrypting files on compromised systems and exfiltrating valuable data to increase the chances of getting paid.

What sets Anubis apart is its ‘wiper mode’ feature, which allows it to permanently delete victims’ files and prevent recovery. This makes the group particularly dangerous, as even organizations with backups may lose critical data.

Impact on Coca-Cola and Fairlife

Coca-Cola stated that, based on current information, the incident has not had and is not reasonably likely to have a material impact on the company’s financial condition or results of operations.

Still, the breach raises concerns about the security of supply chain partners. Fairlife, a popular dairy brand, relies on Coca-Cola’s distribution network, and any prolonged disruption could affect retail availability.

Related incidents in the dairy and food sector have shown that ransomware attacks can have cascading effects. For example, the DentaQuest data breach impacted over 23 million people, and the MCBS data breach affected 1.2 million individuals. Even Australian energy giant Origin faced a data breach after being hacked.

What Should Businesses Learn from This?

The Fairlife attack underscores the importance of robust cybersecurity measures, especially for subsidiaries of large corporations. Attackers often target smaller entities within a larger organization, knowing they may have weaker defenses.

Key takeaways for businesses:

• Ensure subsidiaries and third-party partners have strong security protocols.
• Regularly back up critical data and test recovery procedures.
• Monitor for signs of double-extortion ransomware, including wiper capabilities.
• Have a response plan that includes communication with customers and regulators.

As the Anubis group continues its activities, the cybersecurity community will be watching closely. For now, Coca-Cola and Fairlife are left to manage the fallout of a breach that could have been prevented with stronger defenses.

One Request, Full Control

Here’s the nightmare scenario every site owner dreads: an anonymous HTTP request — no login, no special privileges, nothing — and your WordPress installation is running code it shouldn’t. That’s the reality of wp2shell WordPress flaw, a core vulnerability that makes even a bare install with zero plugins exploitable.

The bug sat in WordPress core itself. Every site running version 6.9 or 7.0 was in range. That’s not a niche subset — that’s a massive chunk of the web’s content management backbone.

The Discovery: Assetnote’s Adam Kues

Adam Kues at Assetnote, the attack surface management arm of Searchlight Cyber, found the flaw. He reported it responsibly, and the WordPress team got to work. But the timeline here matters. The disclosure wasn’t a slow burn — it was a race to patch before the public knew what was possible.

Kues’s background in finding similar issues in other platforms likely helped him spot this one. Assetnote has a track record of digging into CMS internals, and this find is squarely in their wheelhouse.

What the Patch Looks Like

On Friday, WordPress shipped two versions: 6.9.5 and 7.0.2. Both close the hole. But here’s the twist — the team also enabled what it calls forced updates through the auto-update system. That’s a significant move. WordPress has always nudged users to update, but forcing the issue for a security patch is a departure from the usual gentle reminder.

The forced update mechanism means that even sites with auto-updates disabled for minor versions might get the fix pushed through. It’s a pragmatic response to a critical flaw, but it also raises questions about control. Do site owners want WordPress deciding when to update? In this case, the answer is probably yes — because the alternative is being hacked.

Why Core Bugs Are Especially Dangerous

Plugins get blamed for most WordPress breaches, and rightly so. But a core vulnerability changes the calculus. It’s not about a badly coded third-party add-on; it’s the foundation itself that’s cracked. The wp2shell WordPress flaw requires no plugins, no themes, no configuration changes. Out-of-the-box WordPress is vulnerable.

That’s why this one feels different. The attack surface is every single site running the affected versions. No excuses, no workarounds, no “just disable that plugin.”

What Site Owners Should Do Right Now

If you haven’t updated yet, stop reading and do it. Here’s the checklist:

• Check your WordPress version — if it’s below 6.9.5 or 7.0.2, you’re exposed.
• Log into your admin dashboard and look for the update prompt. If it’s not there, check manually under Updates.
• Verify the update actually applied by checking the version number in At a Glance or via wp-cli if you use it.
• If you’re on a managed host, confirm they’ve applied the patch on their end.

Don’t assume the forced update got you. It’s designed to help, but you should still verify. A quick check takes two minutes and saves you from a potential takeover.

The Bigger Picture: WordPress Security in 2025

This isn’t the first core flaw, and it won’t be the last. WordPress powers over 40% of the web, making it a prime target for attackers who want maximum impact with minimal effort. The wp2shell WordPress flaw is a reminder that even the most popular CMS isn’t immune to critical bugs.

The good news? Responsible disclosure works. Assetnote didn’t sell the exploit or leak it; they reported it, and WordPress responded with a patch and an aggressive update push. That’s how the system is supposed to work.

But it also highlights the importance of staying current. If you’re running an old version of WordPress because you’re afraid updates will break something, this is your wake-up call. The risk of staying behind far outweighs the risk of a minor plugin incompatibility.

Final Thoughts

The wp2shell WordPress flaw is a serious issue, but it’s also a solved one — provided you update. Check your version, apply the patch, and move on. And maybe take a moment to appreciate the security researchers who find these bugs before the bad guys do.

For more on keeping your site secure, check out our guide on WordPress security hardening and learn how to protect your site from brute force attacks. Staying informed is half the battle.

Detained at the Airport

Armenia has held a Russian tourist named Aleksandr Ermakov in a detention center since June 28, on a U.S. extradition request for a REvil ransomware suspect named Aleksandr Ermakov. The problem? His lawyers say they’re different people entirely.

His wife, Maria Yurova, told REN TV that border officers pulled him out of the departure hall at Yerevan’s Zvartnots airport, held up a phone with a photo of him off his VKontakte page, and walked him into a side room. He never boarded his flight home.

That was over two weeks ago. He’s been sitting in an Armenian detention facility ever since, waiting for a court to decide whether he’ll be shipped to the United States to face charges tied to one of the most damaging ransomware gangs in recent memory.

Who Is the REvil Suspect?

The U.S. indictment names Aleksandr Ermakov as a key figure in REvil, the Russian-speaking ransomware syndicate responsible for high-profile attacks on Kaseya, JBS Foods, and dozens of other targets. The group extorted millions before law enforcement disrupted its operations.

But the man held in Yerevan, according to his legal team, is a different Aleksandr Ermakov — a tourist with no connection to cybercrime. His lawyers argue the U.S. warrant relies on a mistaken identity, pointing to the VKontakte photo as the sole link.

It’s a scenario that raises uncomfortable questions about how extradition requests are processed when names match but people don’t.

Why Names Alone Aren’t Enough

In international warrants, a name is rarely sufficient. Authorities typically rely on additional identifiers — birth dates, passport numbers, addresses, or biometric data. In this case, the photo from VKontakte appears to be the primary evidence tying the detained man to the suspect.

His lawyers say that’s flimsy. They’ve filed motions demanding the U.S. provide concrete proof, not just a social media snapshot. The Armenian court has yet to rule on the extradition request, and the case is now caught in a legal limbo.

This isn’t the first time a Russian national has been caught in an extradition dispute involving cybercrime. In recent years, several suspects have been arrested in third countries on U.S. warrants, with varying outcomes. Some are extradited; others are released when evidence falls apart.

The Human Cost of a Name Mix-Up

For Yurova, the ordeal is a nightmare. She’s been publicly pleading for her husband’s release, insisting he’s an ordinary traveler, not a hacker. “He’s not a criminal,” she told REN TV. “He’s being held for something he didn’t do.”

Her account of the arrest — the sudden pull from the departure hall, the phone with his photo, the side room — paints a picture of a process that can feel arbitrary and intimidating.

Meanwhile, the real REvil suspect, if the lawyers are right, remains at large. That’s the irony: while an innocent man sits in detention, the actual target of the U.S. warrant may still be operating freely.

What Happens Next?

The Armenian court will eventually decide whether the extradition proceeds. If the defense succeeds, Ermakov walks free — but the damage to his reputation and his family’s peace of mind is already done.

If the extradition goes through, he faces a long legal battle in the U.S., where the stakes are far higher. A conviction on ransomware charges can carry decades in prison.

For now, the case highlights a broader issue: the need for better verification in international warrants. A photo and a name shouldn’t be enough to tear a person from their life. Yet here we are.

As the legal process grinds on, one question lingers: how many other cases like this are out there, where the system gets it wrong?