Welcome to this week’s Food Exec Brief, your strategic intelligence roundup for food and beverage manufacturing leaders. This week, we’re covering:
- A ransomware attack forced Coca-Cola to halt all US production at Fairlife this week. The full scope of the breach is still unknown, and the food and ag sector has absorbed roughly 205 ransomware attacks in 2026 alone.
- The 2026 Cyclospora outbreak linked to Taylor Farms iceberg lettuce at Taco Bell has produced 1,644 confirmed cases and 94 hospitalizations. IFPA is calling it a failure of end-to-end traceability and pushing Congress to stop stalling on the FDA Food Traceability Rule.
- FDA revoked one petroleum-based color additive and proposed eliminating a second this week while confirming a mandatory GRAS notification rule is coming before year-end. Legal challenges are near-certain, and a binding final rule is unlikely before 2028 at the earliest.
Fairlife’s production just stopped. The industry should take that personally.
Coca-Cola disclosed in an SEC filing this week that a ransomware attack has halted all US production at Fairlife, its ultra-filtered dairy and protein shake business. The company said it is working with law enforcement and outside cybersecurity experts to determine the full scope of the breach and restore normal capacity. Fairlife’s Canadian operations were not affected. The incident comes just months after Coca-Cola announced a $650 million investment to expand its Coopersville, Michigan facility, and as a new 745,000-square-foot plant in Webster, New York, was scheduled to open this year. (Learn more)
Fairlife surpassed $1 billion in annual retail sales in 2022 and has been one of Coca-Cola’s fastest-growing businesses, which makes this breach harder to dismiss as a niche problem. The Food and Agriculture Information Sharing and Analysis Center confirmed the attack and noted the sector has been hit with about 205 ransomware attacks in 2026 so far, representing approximately 4.9% of all attacks across industries. “The food and agriculture sector has been pulled into the same broad, opportunistic targeting that hits every other sector,” said Scott Algeier, executive director of Food and Ag-ISAC. Attackers scan for exposed systems at machine speed and sort out the victim’s identity afterward. (Learn more)
Why it matters: Fairlife’s production systems went dark because attackers found a way in. Every food manufacturer running connected OT systems, expanding facilities, or carrying recently acquired infrastructure is in the same position. The only variable is timing.
The Cyclospora outbreak exposed what traceability gaps really cost.
The CDC and FDA identified shredded iceberg lettuce from Taylor Farms de Mexico, served at Taco Bell locations across five states, as the source of a 2026 multi-state Cyclospora outbreak. As of July 19, the outbreak had produced 1,644 laboratory-confirmed cases and 94 hospitalizations in Indiana, Kentucky, Michigan, Ohio, and West Virginia. Taylor Farms de Mexico responded by voluntarily pulling all iceberg lettuce sourced from central Mexico from the US market. The recall extended beyond foodservice: Marketside-brand product sold at Walmart was included, and the CDC told any retailer who received the product to discard it. (Learn more)
IFPA issued a statement July 19 calling for end-to-end traceability and opposing the continued delays to the FDA Food Traceability Rule. Chief science officer Max Teplitski said the association is pushing Congress and the administration to strengthen the FDA’s Human Foods Program, implement traceback capability throughout the supply chain, and fund state produce safety programs. “Our first concern is for those affected by this Cyclospora outbreak and we all want to find its root cause,” Teplitski said. The association’s position: the supply chain and regulators need to build this infrastructure before an outbreak, not scramble to piece it together during one. (Learn more)
Why it matters: When an outbreak takes this long to trace back to a single farm and supplier, the gap in traceability infrastructure is the story. The FDA Food Traceability Rule exists to close it. Every delay adds to what the next recall costs, and those costs don’t stay contained to the supply chain.
FDA is moving on color additives now and GRAS by December. Start your regulatory inventory.
FDA issued a final order revoking the authorized use of Orange B as a food color additive and proposed revoking the use of Citrus Red No. 2 this week. Both are petroleum-based additives the agency says have been abandoned by industry. Citrus Red No. 2 has been authorized since 1959 for coloring the skins of mature oranges and is now open for public comment through August 24, 2026. HHS Secretary Robert F. Kennedy Jr. framed both actions as part of the administration’s broader push to phase out petroleum-based dyes from the food supply. (Learn more)
The color additive moves are the visible action. The GRAS rulemaking is the one with real operational weight. FDA’s 2026 Unified Regulatory Agenda, released July 3, confirms the agency plans to publish a proposed mandatory GRAS notification rule before year-end. The rule is classified as “Economically Significant,” meaning it could affect the economy by at least $100 million annually, and would presume covered food substances are not GRAS unless a notification has been filed with FDA. Self-affirmed GRAS, the standard practice for decades, would no longer be a lawful pathway under the rule. Legal challenges are considered nearly certain. Even if FDA publishes on schedule in December, a binding final rule is unlikely before late 2028 or 2029. (Learn more)
Why it matters: Companies that use the proposed-to-final-rule window to conduct a GRAS inventory, identify gaps, and file substantive comments will have options that late movers won’t. The comment period is where manufacturers have influence over how the rule takes shape. After that, it moves to the courts.
The Food Exec Brief provides weekly insights for food and beverage manufacturing leaders and publishes every Friday.
