Anubis Ransomware Hits Coca-Cola Fairlife: OT Networks Become New Ransom Target, US Dairy Production Halted

Anubis ransomware hit Coca-Cola's Fairlife dairy brand, halting production at 4 US plants for nearly two weeks. Attackers claimed 1TB data theft and encrypted Nutanix systems. Incident highlights ransomware threat to OT networks.

On July 16, 2026, Coca-Cola filed a Form 8-K with the U.S. Securities and Exchange Commission (SEC), disclosing a ransomware attack on its high-protein dairy brand Fairlife. The attack temporarily halted Fairlife U.S. production systems. Canadian operations were unaffected. On July 20, the Anubis ransomware group listed Fairlife on its dark web leak site, claiming theft of 1TB of confidential data and encryption of Nutanix virtualization infrastructure.

Event Overview

Fairlife is a Coca-Cola dairy brand with over $1 billion in annual revenue, known for ultra-filtered milk and protein shakes. Attack timeline:

• July 16: Fairlife discovered unauthorized access, disclosed the incident to the SEC, and paused U.S. production
• July 20: Anubis ransomware group listed Fairlife on its dark web leak site
• July 21-22: Anubis publicly claimed responsibility and threatened to leak data within a week
• July 27: Coca-Cola confirmed most production restored at Fairlife's 4 U.S. plants

Coca-Cola stated product quality and safety were unaffected. Retail supply stayed largely normal due to existing inventory. The incident exposed ransomware's direct threat to operational technology (OT) networks.

Technical Details

Anubis Ransomware Group

Anubis is a ransomware-as-a-service (RaaS) group that emerged in December 2024, reportedly a rebranding of earlier Spinx ransomware. Traits:

• Double extortion: steal data first, then encrypt systems; public leaks as secondary pressure
• Destructive extras: disable volume shadow copies, disrupt security processes, and include a "wiper mode" that permanently deletes files
• Broad targeting: listed ~100 victims in about 18 months across multiple industries and regions

Attack Impact

Anubis claimed it encrypted Fairlife's Nutanix systems and stole about 671GB of data, including:

• HR records
• Engineering/technical documents
• Production data

Impact Assessment

OT Networks Become New Ransom Targets

The attack targeted production operations, not just data. Fairlife runs highly automated food manufacturing. IT/OT convergence turned a cyber incident into a physical outage.

Per European Union Agency for Cybersecurity (ENISA) data, ransomware accounted for 54% of major cyber incidents in critical sectors in mid-2021–2022. Gartner previously predicted that by 2025, 30% of critical infrastructure organizations would experience security incidents affecting OT environments.

Industry Warning

Industrial control systems in food and beverage were originally isolated. Automation, monitoring, and remote management expanded connectivity and created new attack surface. Fairlife is another data point in that trend.

Remediation and Defense

OT Network Hardening

• Segment IT/OT networks to limit lateral movement
• Deploy offline or air-gapped backups for OT systems (3-2-1 strategy)
• Include ransomware scenarios in tabletop exercises and incident response plans
• Review remote access configurations for industrial control systems

General Ransomware Defense

• Deploy endpoint detection and response (EDR) tools
• Implement application allowlisting and least privilege
• Regularly test offline backup restores
• Establish a clear ransomware response decision process

Sources

• CM Alliance: Fairlife Attack Analysis
• Infosecurity Magazine: Coca-Cola Confirms Data Breach
• The CyberSignal: Anubis Claims 1TB Data Theft
• TMCnet: Food Sector Risk Analysis