When fairlife’s U.S. production lines went dark this July, the immediate story was operational. A Coca-Cola-owned dairy brand, suddenly unable to manufacture. But underneath that was something else. A ransomware group holding stolen data. A public parent company deciding what it owed investors, and a growing list of questions nobody could fully answer yet. That’s the version of this incident that legal teams were actually dealing with.
The company confirmed unauthorized access to part of its systems, including production systems, and temporarily suspended U.S. manufacturing as a precaution. Not long after, a group calling itself Anubis claimed on its leak site that it had pulled around 1 TB of data from fairlife’s network and threatened to publish it within a week unless it got paid. Coca-Cola hasn’t verified that number, and that gap — between what a company knows and what an attacker says — is often where the real legal work begins.
The Legal Exposure Nobody Sees Coming Right Away
The obvious risk is regulatory: if personal data belonging to employees or consumers turns out to have been on the affected systems, notification obligations can kick in depending on the jurisdictions involved and how quickly the risk threshold is met. But there’s a second layer that’s easy to underestimate — the commercial one.
Contracts with manufacturers, distributors, and retailers usually have a clause for events outside anyone’s control — things like natural disasters, sometimes called “force majeure.” That clause decides who pays when something outside the company’s control shuts down production. But most of these clauses were written years ago, long before ransomware was common. So when a cyberattack — not a storm or a fire — is what stops production, it’s not clear the clause even applies. That’s not a small detail. It decides who ends up paying for the disruption: the company, or the businesses waiting on its products.
Then there’s the hackers’ claim itself. They say they stole a specific amount of data — but nobody outside the attack has confirmed that yet. This puts companies in a tough spot. Say too little, and it looks like they’re hiding something if the claim turns out to be true. Say too much before it’s confirmed, and they may have to walk it back later, which looks worse. Getting that balance right takes as much careful communication as it does legal judgment.
Practical Steps Legal Teams Are Taking Right Now
- Keep a clear line between what’s been confirmed internally and what a threat actor has claimed — in every draft, memo, and public statement.
- Pull together what’s actually known about what data lived on the affected systems, and who it belongs to.
- Go back through distribution, retail, and manufacturing contracts to check notification deadlines and force majeure language.
- Start a preservation record now — internal decisions, external communications, everything — even while the investigation is still open.
- Loop in privacy, technical, and outside advisors early rather than waiting for a fuller picture to emerge.
- Set up a document review process that can scale, in case the volume of potentially affected material turns out to be large.
The Unglamorous Work That Actually Matters
Most of a cyber incident never makes the news. It’s not the ransom note or the leak site — it’s the weeks after, spent figuring out exactly what was exposed, keeping a clear record of every decision made along the way, and making sure notifications go out correctly and on time. That work is slow, detailed, and easy to get wrong under pressure.
Aeren LPO works alongside law firms and in-house legal teams to handle exactly that. Our cyber incident response support covers breach review, data mapping, privilege log preparation, regulatory notification drafting, eDiscovery, and DSAR handling.
When production is down and a hacker has set a deadline, there’s no time to build a review process from zero. Having one ready — and a team that documents its work as carefully as it moves fast — matters more than most companies realize, especially once litigation or a regulator gets involved.
Explore Cyber Incident Response Review
Strengthen your organization’s preparedness with our tailored review.