Coca-Cola’s Fairlife has halted all US production due to a ransomware attack, affecting the company’s ultra-filtered dairy and protein shake business. The incident is still being investigated by law enforcement and outside cybersecurity experts to determine the full scope of the breach.
Impact on Fairlife Operations
Fairlife’s Canadian operations were not affected by the attack. The company had recently announced a $650 million investment to expand its Coopersville, Michigan facility and was scheduled to open a new 745,000-square-foot plant in Webster, New York.
According to the Food and Agriculture Information Sharing and Analysis Center, the food and agriculture sector has been hit with approximately 205 ransomware attacks in 2026, representing about 4.9% of all attacks across industries.
Scott Algeier, executive director of Food and Ag-ISAC, stated that the food and agriculture sector has been pulled into the same broad, opportunistic targeting that hits every other sector. Attackers scan for exposed systems and sort out the victim’s identity afterward.
Cyclospora Outbreak and Traceability
A 2026 multi-state Cyclospora outbreak linked to Taylor Farms iceberg lettuce at Taco Bell has produced 1,644 confirmed cases and 94 hospitalizations. The outbreak exposed gaps in end-to-end traceability, prompting the International Fresh Produce Association (IFPA) to call for Congress to stop stalling on the FDA Food Traceability Rule.
IFPA’s chief science officer, Max Teplitski, emphasized the need for a stronger FDA Human Foods Program, traceback capability throughout the supply chain, and funding for state produce safety programs. Teplitski stated that the association’s primary concern is for those affected by the outbreak and that the supply chain and regulators need to build traceability infrastructure before an outbreak, not during one.
The FDA Food Traceability Rule aims to close the gap in traceability infrastructure, and every delay adds to the cost of the next recall. The recall of Taylor Farms iceberg lettuce extended beyond foodservice, with Marketside-brand product sold at Walmart also being pulled from the market due to grocery sales concerns.
FDA Actions on Color Additives and GRAS
The FDA has revoked the authorized use of Orange B as a food color additive and proposed revoking the use of Citrus Red No. 2. Both are petroleum-based additives that the agency says have been abandoned by industry. The proposed revocation of Citrus Red No. 2 is open for public comment through August 24, 2026.
The FDA also plans to publish a proposed mandatory GRAS notification rule before year-end, which would presume covered food substances are not GRAS unless a notification has been filed with FDA. This rule is classified as “Economically Significant” and could affect the economy by at least $100 million annually.
Companies that use the proposed-to-final-rule window to conduct a GRAS inventory, identify gaps, and file substantive comments will have options that late movers won’t. The comment period is where manufacturers have influence over how the rule takes shape.
The FDA’s actions on color additives and GRAS are part of the agency’s plans, as confirmed by the FDA’s 2026 Unified Regulatory Agenda, which includes publishing the proposed mandatory GRAS notification rule before year-end.
Food and beverage manufacturers should take note of the potential impact on their operations and start preparing for the changes ahead.
This includes reviewing their use of color additives and GRAS substances.
They must also ensure they have the necessary infrastructure in place to comply with the new rules.
The food and agriculture sector is not immune to ransomware attacks.
The Fairlife incident serves as a reminder of the importance of cybersecurity in the industry.
Companies must take proactive steps to protect themselves from these types of attacks, including implementing robust security measures and conducting regular risk assessments, especially in light of lawsuits related to food safety.