A ransomware attack involving Fairlife has temporarily halted the dairy brand’s production operations in the United States.

The Coca-Cola Co. said July 16 that an unauthorized third party accessed a portion of Fairlife’s systems, including systems connected to production. Coca-Cola owns the Chicago-based dairy company.

Fairlife initiated its “incident response and business continuity protocols” upon discovering the intrusion. The company is investigating the attack with outside advisers and cybersecurity experts and has notified law enforcement. While the full scope of the incident is unknown, Coca-Cola said Fairlife’s product quality and safety were not affected.

Fairlife’s Canadian production operations were not affected by the incident. The company did not provide a timetable for restoring U.S. production.

Why this matters for convenience services operators

The shutdown illustrates how ransomware can disrupt physical operations — beyond the data and administrative systems often thought of when data breaches occur. 

From a product perspective, a prolonged interruption could affect the availability of Fairlife products used in micro markets, vending machines, smart coolers and workplace foodservice programs. The company did not provide details about existing inventory or potential shortages. Availability could differ by distributor, product and market.

The incident also draws attention to wider cybersecurity concerns in unattended retail. In a recent VendingMarketWatch podcast, Tech2Success CEO John Hickey discussed the frequency of cyberattacks against convenience services businesses and advised operators not to wait for a crisis before improving their systems.

“Start with small things. Get something done. Do something. It’s better than doing nothing,” Hickey said.

Hickey said cyber incidents in the convenience services channel can result in locked systems, loss of access to financial accounts, and operational downtime. He also warned that failed or inadequate backups can force a company to rebuild systems after an attack.

Although Coca-Cola has not disclosed how the Fairlife attackers gained access to the company’s systems, Hickey has identified reused passwords, phishing attempts and human error as common vulnerabilities. “We let them in the front door,” he said, when describing attacks that manipulate employees into clicking links or responding to fraudulent requests.

Hickey recommended that operators update weak or reused passwords and enable multifactor authentication. He also encouraged businesses to take incremental security steps rather than delay action until they can implement a complete technology overhaul.

Fairlife and Coca-Cola are working to restore the affected systems and resume U.S. production. The company said its investigation and assessment of the incident are continuing.