Coca-Cola told the US Securities and Exchange Commission this week that ransomware attackers hit its Fairlife dairy subsidiary, forcing an immediate shutdown of production lines across the United States. The company's Canadian operations stayed online, but the US facilities remain suspended with no restart date announced.
The attack fits a worrying pattern. The Food and Agriculture Information Sharing and Analysis Center (Food and Ag-ISAC) reported that the sector has absorbed about 205 cyberattacks so far in 2026, accounting for roughly 4.9 percent of all reported incidents. That number keeps climbing, and experts warn that food manufacturers have become prime targets for ransomware gangs who know the sector can't afford extended downtime.
What Happened at Fairlife
Coca-Cola disclosed the breach in an SEC filing, saying it's working with cybersecurity experts and law enforcement to contain the damage. Fairlife, the ultra-filtered milk brand that Coca-Cola fully acquired in 2020, reported $1 billion in annual retail sales as of 2022. The company had just announced a $650 million expansion plan for its Coopersville, Michigan facility in March 2026.
Fairlife's Webster, New York facility — a 745,000 square-foot plant announced in 2023 — was scheduled to open this year. That timeline now sits in limbo. Company officials told the SEC they're still assessing the full scope of the breach and what impact it will have on operations.
The company reassured customers that product quality and safety haven't been affected, suggesting the ransomware locked administrative and production control systems rather than contaminating physical supply chains. That's small comfort for grocery retailers who now face empty dairy shelves.
Scott Algeier, executive director of the Food and Ag-ISAC, said attackers aren't deliberately targeting dairy companies — they scan the internet at machine speed for exposed, vulnerable systems and only learn the victim's industry after they've already broken in. "The food and agriculture sector has been pulled into the same broad, opportunistic targeting that hits every other sector," Algeier told Cybersecurity Dive.
The Bigger Picture: Ransomware Surge Hits Every Sector
The Fairlife attack is part of a broader ransomware surge affecting organizations across industries. Security researchers say they're tracking more than one new victim disclosure per hour globally in July 2026, and the pace shows no signs of slowing.
The agriculture sector, once considered a lower-risk target, now finds itself in the crosshairs alongside energy, healthcare, and finance. Past incidents show just how damaging these attacks can be. Arizona Beverages struggled with weeks-long production disruptions after a 2019 ransomware attack. Food distributor UNFI faced similar prolonged downtime in 2025. For Fairlife — a brand that sells ultra-filtered milk with DHA Omega-3 and 42-gram protein shakes — every day of suspended US production means lost shelf space and market share to competitors.
The "pay up or not" calculation has never been more agonizing. Companies hit by ransomware must decide whether to pay attackers who may not restore access, or refuse and risk permanent data loss, weeks of downtime, and public exposure of stolen data. TechCrunch reported that Coca-Cola hasn't disclosed whether it intends to pay the ransom demand. Many companies in the food sector pay quietly and never admit it, afraid of attracting follow-up attacks.
Why the Food Sector Became a Target
Food manufacturers run tight operations with thin profit margins. Their production lines depend on industrial control systems, enterprise resource planning software, and supply chain management platforms — all of which can be knocked offline by ransomware.
The calculation for attackers is simple: a dairy that can't produce milk for school lunch programs or hospital cafeterias faces pressure to resume operations fast. That makes food companies more likely to pay ransoms quickly, without the lengthy negotiations seen in other sectors.
Algeier's point about "opportunistic targeting at machine speed" is key. Attackers scan the open internet for unpatched VPN appliances, exposed Remote Desktop Protocol ports, and forgotten cloud instances. When they find one, they check what company owns it. If that company produces something critical — like milk, bread, or medicine — the attackers know they've found a motivated payer.
The 205 attacks logged so far in 2026 represent a sharp increase over previous years. The Food and Ag-ISAC says this is driven partly by more sophisticated ransomware operations and partly by the growing attack surface as food companies connect their factories to the internet for remote monitoring and predictive maintenance.
JadePuffer: AI Agents Now Run Ransomware Operations
While the Fairlife attackers remain unidentified, the ransomware world itself is changing fast. In early July, cloud security firm Sysdig documented what it believes is the first known ransomware operation — dubbed JadePuffer — executed entirely by a large language model AI agent.
Sysdig's researchers say JadePuffer used an autonomous AI agent to conduct reconnaissance, steal credentials, move laterally across the target network, escalate privileges, and encrypt data. The AI adapted its behaviors in real time: when one API request returned XML instead of the expected JSON, the next payload adjusted its parsing logic automatically — a level of flexibility previously expected only from human attackers.
The attackers gained initial access by exploiting CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow, a popular open-source framework for building LLM applications. The flaw was patched in April 2025, but unpatched instances remain exposed on the internet.
Once inside, the AI agent encrypted 1,342 Nacos service configuration items, dropped the original database tables, and left a ransom note demanding payment in Bitcoin. Notably, the encryption key was randomly generated but never stored or transmitted back to the attacker — an operational failure that would prevent decryption even if the ransom were paid.
Sysdig said the operation showed "the age of agentic threat actors has arrived," lowering the skill required for conducting damaging cyberattacks. The researchers also noted that the Bitcoin address listed in the ransom note was an example address from public documentation, suggesting the LLM reproduced it from training data rather than generating a fresh wallet.
What Comes Next
Coca-Cola hasn't given a timeline for when Fairlife's US production will resume. The company is still assessing the full scope of the breach. In the meantime, dairy buyers are looking for backup suppliers, and the incident will likely accelerate calls for stronger cybersecurity requirements across the food supply chain.
The Agriculture ISAC's 205-attack count for 2026 won't stop climbing. Every unpatched server, every exposed RDP port, every forgotten cloud instance creates a potential entry point. For companies in the food sector, the question has shifted from "if" an attack will happen to "how fast can they recover when the scanners find them."
As one security analyst put it: attackers scan at machine speed, so defenders need to patch at machine speed too. The Fairlife shutdown is the latest reminder that ransomware isn't just an IT problem — it's a production line problem, a supply chain problem, and for companies that fail to prepare, a survival problem.
For more cybersecurity news and analysis, visit our Cybersecurity section.