Coca-Cola (NYSE: KO) details fairlife ransomware and U.S. production halt
Rhea-AI Filing Summary
The Coca-Cola Company reported that its majority-owned dairy subsidiary fairlife, LLC detected unauthorized third-party access to part of its systems in connection with a ransomware event. The breach affected production-related systems, and fairlife’s U.S. production operations are temporarily suspended, while Canadian production remains unaffected.
After identifying the issue, Coca-Cola activated incident response and business continuity protocols, engaged external cybersecurity experts, and notified law enforcement. The company states that product quality and safety have not been impacted. The investigation into the scope and nature of the incident is ongoing, and Coca-Cola has not yet determined whether the event is reasonably likely to have a material effect on the company.
Positive
- None.
Negative
- None.
8-K Event Classification
Item 8.01 — Other Events
1 item
Item 8.01
Other Events
Other
Voluntary disclosure of events the company deems important to shareholders but not covered by other items.
Key Terms
ransomware event, incident response and business continuity protocols, unauthorized access, Emerging growth company
4 terms
ransomware event technical
"in connection with a ransomware event affecting fairlife systems"
A ransomware event is a cyberattack in which criminals encrypt or lock a company’s data, systems, or devices and demand payment for a decryption key or to prevent public release of stolen information. It matters to investors because such an attack can interrupt operations, reduce revenue, increase recovery and legal costs, trigger regulatory penalties, and harm reputation—similar to a hijacker locking a factory gate and holding output and records hostage.
incident response and business continuity protocols technical
"promptly activated its incident response and business continuity protocols"
unauthorized access technical
"fairlife identified unauthorized access by a third party to a portion of its systems"
Entry into computer systems, networks, facilities, or data by people who do not have permission to be there—whether by hacking, stolen credentials, bypassing locks, or improper insider activity. For investors, unauthorized access matters because it can lead to stolen customer or financial data, operational shutdowns, regulatory fines, and damage to reputation—like someone breaking into a locked file cabinet and taking sensitive documents, which can reduce a company’s value and increase costs.
Emerging growth company regulatory
"Emerging growth company checkbox appears in the registration section"
An emerging growth company is a recently public or smaller public firm that qualifies for temporary, lighter regulatory and disclosure rules to reduce the cost and effort of being public. For investors, it means the company may provide less historical financial detail and face fewer reporting requirements than larger firms, so it can grow more quickly but also carries higher uncertainty—like buying a promising early-stage product with fewer user reviews.
AI-generated analysis. How Rhea-AI works. Not financial advice.
FAQ
What cybersecurity incident did Coca-Cola (KO) disclose involving fairlife?
Coca-Cola disclosed that fairlife, LLC experienced a ransomware event involving unauthorized third-party access to part of its systems, including production-related systems. The company is investigating the scope and impact with support from outside advisors and cybersecurity experts.
How are fairlife’s production operations affected according to Coca-Cola (KO)?
Coca-Cola reported that fairlife’s U.S. production operations are temporarily suspended due to the ransomware-related systems disruption. The company stated that fairlife’s Canada production operations are not currently impacted, highlighting a geographic limitation to the disruption.
Did the ransomware event affect product quality or safety at fairlife, per Coca-Cola (KO)?
Coca-Cola stated that product quality and safety have not been impacted by the fairlife ransomware incident. The disruption is described as affecting systems and production operations rather than the safety or quality of dairy products supplied to customers.
Has Coca-Cola (KO) determined if the fairlife incident is material to the company?
Coca-Cola said it has not yet determined whether the fairlife ransomware incident is reasonably likely to materially affect the company. The full scope, nature and impacts of the event remain under investigation, so any potential materiality assessment is still pending.
What response steps has Coca-Cola (KO) taken after the fairlife ransomware event?
Coca-Cola activated incident response and business continuity protocols, engaged outside advisors and cybersecurity experts, and notified law enforcement. The company is working to complete the investigation, restore affected systems, and bring impacted fairlife operations back online.
UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
WASHINGTON, D.C. 20549
FORM 8-K
CURRENT REPORT
Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934
Date of Report (Date of earliest event reported):
(Exact name of Registrant as specified in its charter)
| (State or other jurisdiction of incorporation) | (Commission File Number) | (I.R.S. Employer Identification No.) | |||||||||
| (Address of principal executive offices) | (Zip Code) | ||||||||||
Registrant’s telephone number, including area code: (404 ) 676-2121
Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the Registrant under any of the following provisions:
| Written communications pursuant to Rule 425 under the Securities Act (17 CFR 230.425) | |||||
| Soliciting material pursuant to Rule 14a-12 under the Exchange Act (17 CFR 240.14a-12) | |||||
| Pre-commencement communications pursuant to Rule 14d-2(b) under the Exchange Act (17 CFR 240.14d-2(b)) | |||||
| Pre-commencement communications pursuant to Rule 13e-4(c) under the Exchange Act (17 CFR 240.13e-4(c)) | |||||
Securities registered pursuant to Section 12(b) of the Act:
| Title of each class | Trading Symbol(s) | Name of each exchange on which registered | ||||||
Indicate by check mark whether the Registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 (§230.405 of this chapter) or Rule 12b-2 of the Securities Exchange Act of 1934 (§240.12b-2 of this chapter).
Emerging growth company ☐
If an emerging growth company, indicate by check mark if the Registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange
Act. ☐
Item 8.01. Other Events.
On July 16, 2026, The Coca-Cola Company (the “Company”) announced that fairlife, LLC (“fairlife”), a dairy company owned by the Company, identified unauthorized access by a third party to a portion of its systems, including its production-related systems, in connection with a ransomware event.
After detecting the issue, the Company promptly activated its incident response and business continuity protocols. The Company’s investigation and assessment of the impact of the incident is ongoing, with the assistance of outside advisors and cybersecurity experts. The Company has also notified law enforcement.
Product quality and safety have not been impacted. However, as a result of the incident, production operations at fairlife in the United States are temporarily suspended. fairlife’s Canada production operations are not currently impacted.
The Company is working diligently to complete the investigation and restore the systems and impacted operations. The full scope, nature and impacts of the incident are not yet known. Accordingly, the Company has not yet determined whether the incident is reasonably likely to materially affect the Company.
The information in this Form 8-K shall not be deemed “filed” for purposes of Section 18 of the Securities Exchange Act of 1934, nor shall it be deemed incorporated by reference in any filing under the Securities Act of 1933, except as shall be expressly set forth by specific reference in such filing.
SIGNATURES
Pursuant to the requirements of the Securities Exchange Act of 1934, the Registrant has duly caused this report to be signed on its behalf by the undersigned hereunto duly authorized.
| THE COCA-COLA COMPANY (REGISTRANT) | ||||||||
Date: July 16, 2026 | By: | /s/ Monica Howard Douglas | ||||||
| Monica Howard Douglas Executive Vice President and Global General Counsel | ||||||||