Chicago's Fairlife Halts US Production After Ransomware Attack

Fairlife has stopped making its lactose-free milk and protein shakes at its U.S. plants after hackers broke into company systems in a ransomware attack, Coca-Cola announced Thursday.

Coca-Cola, which owns the Chicago-based dairy brand, said it discovered "unauthorized access by a third party" to a portion of its systems, including those tied to production. Coca-Cola confirmed the breach was connected to a ransomware event and said it took some operations offline in response.

"Product quality and safety have not been impacted," Coca-Cola said in a statement. "However, as a result of the incident, production operations at fairlife in the United States are temporarily suspended."

Fairlife's Canadian operations have not been affected, according to Coca-Cola. The company said the full scope of the attack is still unknown and that it has notified law enforcement. It is also working with cybersecurity specialists on its investigation and on restoring operations. A Fairlife spokesperson said Friday morning there were no further updates to share.

Fairlife, headquartered in Chicago's West Loop, makes more than $3 billion in annual retail sales. Its lineup includes ultra-filtered milk and protein shakes sold under names like Core Power. The products are sold in grocery stores nationwide, and a pause in U.S. production affects supply from Fairlife's plants to retailers that stock those items.

Ransomware attacks, in which hackers lock up computer systems and demand payment to release them, have hit companies across many industries in recent years. Attackers have targeted household brands and everyday products, calculating that the pressure to keep shelves stocked will push companies to pay quickly or scramble to recover. Recent incidents have knocked out school district networks and left gaps on shelves at national retail and grocery chains.

Coca-Cola has not said how long the shutdown will last, how many Fairlife facilities are affected, or whether hackers demanded a ransom payment. The company has also not detailed what kind of data, if any, was accessed or stolen during the breach. Coca-Cola's statement focused on reassuring customers that products already on shelves remain safe, without addressing what a longer outage could mean for supply.

Fairlife built its business by positioning its products as a premium, protein-heavy alternative to standard dairy milk. That approach helped the brand grow quickly after Coca-Cola took a majority stake in Fairlife years ago and later acquired it outright.

Coca-Cola says it is focused on containment and recovery for now rather than a timeline for restarting U.S. production. The company is continuing to work with outside cybersecurity specialists and law enforcement as it investigates how the breach occurred and when Fairlife's American plants can resume operations.