Anubis Ransomware Group Threatens to Leak 1 TB of Data Stolen From Coca-Cola's Fairlife

A production-halt story becomes a data-extortion story — Anubis's 1 TB leak threat is a claim to watch, not a confirmed breach ledger.

ATLANTA — The Anubis ransomware group has claimed responsibility for the disruptive attack on Coca-Cola subsidiary Fairlife and, after listing the company on its dark-web leak site on July 20, 2026, is reportedly threatening to publish 1 TB (one terabyte) of what it calls "confidential data" unless a ransom is paid. The claim, reported by SecurityWeek on July 22, escalates an incident Coca-Cola disclosed the previous week — when it told investors a ransomware attack had forced it to suspend Fairlife's US milk production — from an operational disruption into a data-extortion threat. As of that reporting, the claim is exactly that: a claim.

The CyberSignal treats the group's assertions as unverified allegations rather than confirmed fact. This piece continues the Fairlife ransomware thread opened when Coca-Cola filed an SEC Form 8-K on July 16, and reports what Anubis has publicly claimed alongside what remains unconfirmed — without reproducing any attacker methods. What is newly on the record is the attribution and the 1 TB figure; what is not is whether that data exists as described, what it contains, or how Coca-Cola will respond.

What Anubis Claimed

According to reporting by SecurityWeek, the Anubis group listed Coca-Cola and Fairlife on its leak website on July 20, 2026 and claimed to have "locked" servers and taken 1 TB of "confidential data." In the same listing the group said it could help restore affected systems within hours if a ransom were paid, and reportedly set a deadline of roughly one week before it would publish the data. Every element of that is the group's own assertion; none has been independently verified, and The CyberSignal reports it as a claim rather than a finding.

What the listing does not establish is as important as what it asserts. The specific categories of information inside the claimed 1 TB — whether it includes employee records, business documents, or operational data — are not detailed in the reporting reviewed, and it is not confirmed whether Anubis has posted any file samples as proof. A leak-site listing is a pressure tactic first and an evidentiary record second: the figure and the framing exist to compel payment, which is precisely why they warrant scrutiny rather than acceptance at face value.

Continuation Context: The Fairlife Production Halt

The leak threat builds directly on the incident Coca-Cola disclosed the previous week. In a Form 8-K filed with the U.S. Securities and Exchange Commission (SEC) on July 16, 2026, the company said a ransomware attack had forced the temporary suspension of Fairlife's US milk production, while stating that product quality and safety were not impacted and that Fairlife's Canadian operations were not affected. That filing named no group and did not say whether data had been taken. The Anubis listing is the first public attribution to attach a named operator to the Fairlife incident.

That sequencing matters for how the story is read. Coca-Cola's disclosure was deliberately bounded — it characterized an operational disruption and explicitly declined to say whether data was stolen or an extortion demand made. Anubis's listing now supplies the extortion narrative the filing withheld, but a criminal group's leak page is not a substitute for confirmation from the company or investigators. The through-line of the food-and-beverage ransomware thread — that the visible damage is stopped production — now carries a second strand: a data-theft claim that has yet to be substantiated.

Coca-Cola's Response and What to Watch For

As of SecurityWeek's July 22 report, Coca-Cola had not publicly commented on the Anubis claim, and SecurityWeek said it had reached out to the company for comment. The CyberSignal is not characterizing the company's position beyond that: no confirmation, denial, or detail on the claimed data had been issued at the time of writing. The most consequential near-term signals are therefore the ones only Coca-Cola or investigators can provide.

The watch-list is short and specific: whether Coca-Cola confirms or disputes that data was taken; whether it addresses the 1 TB figure; whether Anubis posts sample files to support its listing; and the status of Fairlife's US production restoration, which the company had not detailed as of its initial filing. Because the original 8-K deferred any materiality determination, a follow-up or amended filing is the most likely official channel for a substantive update. Until one arrives, the responsible posture is to log the claim and wait for corroboration.

Ransomware-Negotiation Implications for Defenders

Anubis is a ransomware-as-a-service operation that has been active since December 2024 and has listed roughly 100 organizations on its site, using the double-extortion model now standard across the ecosystem — encrypting systems while claiming to hold stolen data as added leverage. That model is familiar from other high-volume operations The CyberSignal tracks, from INC ransomware's leak-site disclosures to The Gentlemen's rapidly growing victim list. The defender-relevant point is not the mechanics but the incentive structure: the leak threat is the product, and the claimed data volume is part of the sales pitch.

One characteristic of Anubis noted by researchers adds a wrinkle to the usual calculus — the operation has been documented carrying a destructive capability able to permanently delete files, which raises the stakes of recovery independent of any negotiation. None of that changes the guidance for organizations watching this unfold. Extortion claims are engineered to force a decision under uncertainty, and the countermeasures are the unglamorous ones — validated offline backups, tested restoration, and a pre-agreed framework for who evaluates a claim's credibility — that hold regardless of whether any single figure on a leak site is accurate. Consumer-facing brands are frequent extortion targets precisely because public pressure is part of the leverage, a pattern visible in cases such as the Carnival extortion disclosure.

Open Questions

Several core questions remain open, and The CyberSignal is not filling them in. It is not confirmed that Anubis holds 1 TB of Fairlife data as claimed, nor what any such data contains; it is not confirmed whether the group has posted sample files; and Coca-Cola had not commented on the claim as of reporting. The status of Fairlife's US production restoration was likewise not detailed in the material reviewed.

What is established is narrow: a ransomware group with a public track record has attached its name to the Fairlife incident and is using a leak-site listing and a stated deadline to pressure payment. Whether that listing reflects a genuine data theft, an exaggerated claim, or something in between will be settled by evidence that has not yet appeared — sample files, a company statement, or investigator findings. The CyberSignal will update the Fairlife thread as verified information emerges, and until then treats the 1 TB leak threat as a claim on the record, not a confirmed loss. Days later, the parent company confirmed a data breach resulted from the Fairlife ransomware attack.

The CyberSignal Analysis

The reported facts above come from SecurityWeek's reporting and Anubis's own public listing; what follows is The CyberSignal's editorial reading. None of the judgments below are new reported facts, and none accepts the group's claim as established.

Signal 01 — Treat the 1 TB Figure as a Sales Pitch, Not a Ledger

The instinct on seeing a round, dramatic number like "1 TB" is to treat it as a measurement. Our reading is that on a leak site it functions as marketing collateral before it functions as evidence — a figure chosen to convey scale and urgency, unaccompanied by the sample files or independent confirmation that would make it verifiable. That does not mean it is false; it means it is unconfirmed, and the two are not the same.

The practical consequence is to resist letting the group's framing set the terms. The number that matters to Coca-Cola and its customers is whatever an investigation ultimately substantiates, not whatever pressures a payment fastest. Until sample data or a company statement appears, the disciplined move is to record the claim and withhold the conclusion.

Signal 02 — The Attribution Is the News; the Data Claim Is Not Yet

It is worth separating what genuinely advanced this week from what did not. The real development is the attribution: a named, established operation has publicly claimed the Fairlife incident, which converts an anonymous disruption into a tracked-group event and gives defenders a known behavioral profile to reason about. That is solid, reportable progress.

The 1 TB data theft, by contrast, has not advanced past assertion. Our assessment is that conflating the two — treating a confirmed attribution as if it also confirmed the data claim — is the most common error in coverage of moments like this. Holding them apart is what keeps the reporting accurate as the story develops.

Signal 03 — Pre-Decide How You Weigh a Claim

The uncomfortable feature of extortion is that it forces judgment under uncertainty and time pressure, exactly the conditions in which judgment is worst. Our view is that the organizations that handle these events well decide in advance how they will evaluate a leak-site claim: who assesses credibility, what evidence counts, and how a deadline changes — or does not change — the calculus.

For everyone watching from outside the incident, the same discipline applies at lower stakes. Log Anubis's claim as a data point about the group's pressure tactics, not as a settled fact about Fairlife's losses, and let corroboration — or its absence — do the rest. The posture that ages well is patience anchored to evidence.

Sources