Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack
The soft drinks giant confirmed on Monday that the recent ransomware attack on its dairy subsidiary Fairlife escalated into a full-blown data breach. Coca-Cola disclosed the cybersecurity incident on July 16, when it suspended production at Fairlife facilities across the United States while investigating the intrusion.
Now, the Anubis ransomware group has claimed responsibility and is threatening to leak stolen data. Here’s what we know so far.
What Happened: Fairlife Production Halted, Then Resumed
Coca-Cola initially announced the cyberattack on July 16, halting operations at four Fairlife facilities in the US. The company said it was working with law enforcement and cybersecurity experts to contain the threat.
By Monday, a statement from Coca-Cola confirmed that “a majority of production has been resumed” at those facilities. The company also acknowledged that the incident involved the “taking of certain data,” though it declined to share further details.
“Retail availability of Fairlife products has been largely unimpacted, due to the availability of existing inventory,” the statement read. “Product quality and safety have not been impacted.”
Anubis Ransomware Group Takes Credit, Threatens Leak
The Anubis ransomware group listed Coca-Cola and Fairlife on its leak website on July 20, claiming to have encrypted files and stolen 1 TB of confidential data. A timer on the site indicated that the stolen data would be made public within hours unless a ransom was paid.
It’s unclear exactly what type of data was compromised, but extortion gangs often exaggerate the importance of stolen files to pressure victims into paying. This is a common tactic in double-extortion schemes.
Who Is the Anubis Ransomware Group?
Active since December 2024, Anubis has listed roughly 100 targeted organizations on its website. The group uses a double-extortion model: encrypting files on compromised systems and exfiltrating valuable data to increase the chances of getting paid.
What sets Anubis apart is its ‘wiper mode’ feature, which allows it to permanently delete victims’ files and prevent recovery. This makes the group particularly dangerous, as even organizations with backups may lose critical data.
Impact on Coca-Cola and Fairlife
Coca-Cola stated that, based on current information, the incident has not had and is not reasonably likely to have a material impact on the company’s financial condition or results of operations.
Still, the breach raises concerns about the security of supply chain partners. Fairlife, a popular dairy brand, relies on Coca-Cola’s distribution network, and any prolonged disruption could affect retail availability.
Related incidents in the dairy and food sector have shown that ransomware attacks can have cascading effects. For example, the DentaQuest data breach impacted over 23 million people, and the MCBS data breach affected 1.2 million individuals. Even Australian energy giant Origin faced a data breach after being hacked.
What Should Businesses Learn from This?
The Fairlife attack underscores the importance of robust cybersecurity measures, especially for subsidiaries of large corporations. Attackers often target smaller entities within a larger organization, knowing they may have weaker defenses.
Key takeaways for businesses:
- Ensure subsidiaries and third-party partners have strong security protocols.
- Regularly back up critical data and test recovery procedures.
- Monitor for signs of double-extortion ransomware, including wiper capabilities.
- Have a response plan that includes communication with customers and regulators.
As the Anubis group continues its activities, the cybersecurity community will be watching closely. For now, Coca-Cola and Fairlife are left to manage the fallout of a breach that could have been prevented with stronger defenses.
