Anubis Claims Attack on Fairlife, a Coca-Cola Subsidiary

The ransomware group Anubis has claimed responsibility for a cyberattack on Fairlife, Coca-Cola's dairy division. The attackers are threatening to publish allegedly stolen corporate data unless the company pays a ransom.

Fairlife makes ultra-filtered milk, protein shakes and health-focused beverages sold across the United States. Its lineup includes Ultra-Filtered Milk, Core Power Protein Shakes and Nutrition Plan.

What we know about the incident

On July 16, The Coca-Cola Company said a ransomware attack had disrupted Fairlife's operations and forced it to halt production at its U.S. facilities. According to the company, the attackers gained unauthorized access to part of its systems, including some tied to production, after which incident response and business continuity plans were activated. Coca-Cola stressed that product quality and safety were not affected, and that production in Canada continued as normal. At the time, the company did not disclose whether data had been stolen, whether a ransom demand had been made, or who was behind the attack.

Anubis's claims

On Monday, Anubis added Fairlife to its dark web leak site, claiming responsibility for the attack and asserting that it had stolen roughly a terabyte of corporate data. The group threatened to publish it unless the company entered negotiations by the end of the week.

According to the extortionists, the attack was carried out about a week before the incident was publicly disclosed, and Fairlife's Nutanix-based infrastructure was completely encrypted. “We attacked their systems a week ago. Just a few days later they immediately reported the incident without trying to follow the instructions we left on the network,” Anubis told BleepingComputer, adding that recovery is impossible without the encryption key.

The publication was unable to independently confirm the theft of data, the encryption of the systems, or the volume of the stolen information. Coca-Cola declined to comment.

Who Anubis is

Anubis operates under a ransomware-as-a-service model and emerged in December 2024, since then attacking organizations around the world across a wide range of industries. The group is known for combining data theft with file encryption, using the stolen information as leverage to pressure its victims. Last year, its arsenal also gained a wiper that destroys a victim's files to make recovery impossible.

Source: Bleeping Computer