Coca-Cola has confirmed that criminals stole data from its Fairlife subsidiary — the ultra-filtered milk brand best known in US grocery stores — in a ransomware attack earlier this month. The company disclosed the incident to the SEC on July 16, 2026 and acknowledged on July 27 that “an unauthorized third party” accessed its systems and took “certain data.” A ransomware gang known as Anubis claims responsibility and says it stole roughly 1 TB of files, threatening to publish them after a payment deadline expired earlier today. Coca-Cola has emphasised that product quality and safety were never at risk and that stock on shelves is unaffected, but the company has not yet said whose personal information was in the stolen files or how many people it involves.
For now this is a corporate data theft — the missing piece is a formal breach-notification listing exactly what was taken (customer records, employee records, or business documents). Until Coca-Cola publishes that, anyone who has interacted with Fairlife recently — signed up for coupons, contacted customer service, or done business with the company — should assume their contact details may be in criminal hands and treat any Fairlife-branded email, text or phone call arriving out of the blue with extra scepticism.
How to check if you’re affected
Affected products are anything under the Fairlife brand (Fairlife milk, Core Power, YUP!, and fairlife nutrition plan) — the incident is at the parent company’s IT systems, not the products themselves. You cannot check the leak directly, but you can protect yourself now: watch your inbox for phishing emails claiming to be from Fairlife or Coca-Cola about “refunds,” “product recalls,” or “loyalty rewards” — real recall notices come through the FDA and retailers, not out-of-the-blue emails. Never click links or open attachments in those emails; visit fairlife.com directly if you want to check for real news. If you used the same password for a Fairlife or Coca-Cola account and any other important account (email, bank, shopping), change the other passwords now and turn on two-factor authentication where possible. Watch for a formal breach-notification letter in the coming weeks — if one arrives naming you, follow its instructions on free credit monitoring.