Latest / Tech Talks With Kinsoft / Coca-Cola's Fairlife – The Ransomware Attack That Stopped the Milk

Transcript

Coca-Cola's Fairlife – The Ransomware Attack That Stopped the Milk · Tech Talks With Kinsoft

• 0:00
  So picture this for a second. You are walking
• 0:02
  down the supermarket aisle and you are looking
• 0:04
  for your usual milk, right? Right. Just a totally
• 0:07
  normal grocery run. Exactly. Yeah. But you get
• 0:11
  to the dairy section and there's just this big
• 0:14
  empty space on the chilled shelf where the milk
• 0:17
  should be. Which is frustrating, obviously. Yeah.
• 0:20
  And, you know, your first thought is probably
• 0:22
  that it is just a supply chain hiccup. Like maybe
• 0:25
  a trucker strike or, I don't know, a broken processing
• 0:28
  valve somewhere down the line? Sure, because
• 0:30
  we see an empty shelf and we just automatically
• 0:31
  assume a physical failure. Right. But that empty
• 0:35
  physical space was actually the direct manifestation
• 0:38
  of a cyber attack. It was essentially an invisible
• 0:41
  line of malicious code that forced thousands
• 0:44
  of dairy cows to, well, stop producing milk.
• 0:47
  I mean, technically the cows kept right on going.
• 0:49
  Well, yeah, true. The cows didn't stop. But the
• 0:53
  billion -dollar infrastructure designed to pasteurize
• 0:56
  and bottle that milk just ground to a complete
• 0:58
  and sudden halt. It is wild. It really forces
• 1:02
  a complete reframing of how we view the physical
• 1:05
  logistics around us, you know. Increasingly,
• 1:08
  these failures are entirely digital, just cascading
• 1:11
  right into the physical world. Which is the core
• 1:13
  mission. of our deep dive today. We're looking
• 1:16
  at the ransomware incident that recently hit
• 1:19
  Coca -Cola's dairy subsidiary, Fairlife. It is
• 1:22
  a huge case study. It really is. We are going
• 1:24
  to explore the mechanics of how digital threats
• 1:26
  are crossing that boundary into physical manufacturing
• 1:29
  and why this matters to businesses of literally
• 1:32
  any size. Plus, what you can learn from how a
• 1:35
  massive multinational handles a total operational
• 1:37
  shutdown. And Fairlife is just a particularly
• 1:40
  compelling lens for this because of its sheer
• 1:42
  scale. It is massive. Yeah, it's this ultra filtered
• 1:45
  milk brand that essentially operates as one of
• 1:48
  Coca -Cola's quiet juggernauts. I mean, we are
• 1:50
  talking over a billion U .S. dollars in annual
• 1:53
  retail sales. Wow. Right. It is a highly optimized,
• 1:56
  physically intensive operation. OK, let's unpack
• 1:59
  this, because when we think of ransomware, we
• 2:01
  usually picture, I don't know, hacker in a hoodie
• 2:04
  locking up spreadsheets or stealing credit card
• 2:07
  numbers. The classic movie trope. Exactly. We
• 2:11
  don't picture them stopping dairy cows and halting
• 2:13
  literal milk production. But on July 16th, that
• 2:17
  optimization hit a brick wall. It did. Coca -Cola
• 2:20
  filed a formal report with the SEC stating that
• 2:23
  Fairlife had experienced... I think the phrasing
• 2:27
  was unauthorized third party access to its systems.
• 2:29
  Right. Specifically noting that production related
• 2:32
  systems were caught up in a ransomware event.
• 2:34
  And the immediate consequence of that was that
• 2:36
  all U .S. production of Fair Life was temporarily
• 2:39
  suspended, just totally frozen. Though it is
• 2:41
  worth noting the Canadian operations kept running.
• 2:44
  Oh, right. Because they were running on separate
• 2:46
  systems. Right. So they were unaffected and product
• 2:48
  safety was never compromised. But those core
• 2:51
  U .S. factories were just dead in the water.
• 2:53
  Yeah. And before we get into the mechanics of
• 2:56
  why those factories came to a halt, we should
• 2:58
  probably note what the sources say we don't know
• 3:00
  yet. Good point. There are a few unknowns. Like,
• 3:03
  as of now, no specific group has actually claimed
• 3:06
  responsibility for this intrusion. Right. And
• 3:08
  we don't know if data was stolen or if a ransom
• 3:11
  was demanded or if they even paid one. Yeah,
• 3:13
  those details usually trickle out later anyway.
• 3:16
  But the facts on the ground are stark enough.
• 3:19
  Hackers breached a network and physical conveyor
• 3:21
  belts just stopped moving. What's fascinating
• 3:24
  here is the distinction between two totally different
• 3:27
  technological environments. You have the IT side
• 3:29
  and then you have the OT side. OK, so break that
• 3:31
  down for us. What is the difference? So IT is
• 3:34
  information technology. This is the office layer,
• 3:37
  right? corporate emails, human resources, accounting
• 3:41
  files, customer records. It is all the data that
• 3:44
  manages the business. Right. The stuff sitting
• 3:46
  on office servers. Exactly. And on the other
• 3:48
  side, you have operational technology or OT.
• 3:52
  This is the machine layer. So the factory floor.
• 3:54
  Yeah. The actual code that tells a mechanical
• 3:56
  valve to open for exactly three seconds to fill
• 3:59
  a bottle or, you know, monitors pasteurization
• 4:02
  temperatures to make sure everything meets FDA
• 4:04
  compliance. Wait. So if these layers do totally,
• 4:07
  completely different things, why does an email
• 4:10
  hack stop a factory valve? I mean, it sounds
• 4:14
  like someone breaking into the manager's office
• 4:16
  of a restaurant and somehow all the stoves in
• 4:18
  the kitchen instantly shut off. That is a really
• 4:21
  great analogy. And the answer is efficiency.
• 4:24
  For decades, those two worlds were physically
• 4:27
  separate. Like completely disconnected. Yeah.
• 4:29
  Historically, they were entirely air -gapped.
• 4:31
  The network running the accounting department
• 4:33
  had literally no physical cable connecting it
• 4:36
  to the network running the robotic arms on the
• 4:38
  assembly line. That makes sense. But over the
• 4:40
  last 20 years, businesses wanted real -time data.
• 4:43
  They wanted the IT system to know exactly how
• 4:46
  many bottles the OT system produced today so
• 4:48
  it could automatically adjust supply chain orders
• 4:51
  for tomorrow. So they built a bridge between
• 4:53
  the man - manager's office and the stoves. Exactly.
• 4:56
  And when crooks breach that office layer now,
• 4:59
  there is very often a direct path right to the
• 5:02
  machines. Which is terrifying. It is. But there
• 5:06
  is a crucial nuance here. Sometimes attackers
• 5:09
  do reach the OT directly and mess with the machines.
• 5:12
  But just as often, companies shut down production
• 5:16
  deliberately. Wait, really? They hit the emergency
• 5:19
  stop themselves? Yeah. They pull the plug out
• 5:21
  of pure necessity. because they can no longer
• 5:24
  trust their IT systems to do quality control.
• 5:27
  Oh, I see. So even if the machines pumping the
• 5:29
  milk are fine, you still have a massive problem.
• 5:32
  Right. In the dairy industry, you have these
• 5:34
  incredibly strict regulatory requirements. You
• 5:36
  have to track exact batch numbers, continuous
• 5:39
  temperature logs. If the system that verifies
• 5:42
  that data is locked up by ransomware, you can't
• 5:45
  prove the milk is safe. You basically have a
• 5:47
  physical product that has become a giant liability,
• 5:49
  even if the pasteurizer works. Without the digital
• 5:52
  compliance log, you can't legally put it on a
• 5:55
  truck. Exactly. The safest move is just to stop
• 5:57
  the line. Which brings up a really uncomfortable
• 6:00
  reality for, well, for any physical business.
• 6:03
  It isn't just giants like Coca -Cola. Oh, absolutely
• 6:05
  not. Right. If you run a regional food processor
• 6:07
  or a local transport firm or even a local trades
• 6:11
  business where you use digital systems to schedule
• 6:14
  jobs, you have an OT layer. Any business that
• 6:16
  uses digital instructions to manipulate physical
• 6:18
  reality has this exact vulnerability. So how
• 6:22
  do you survive it? Well, the first crucial defense
• 6:24
  is segmentation. The office network must be separated
• 6:28
  from the operations floor with very tightly controlled
• 6:30
  crossing points. Right. So you can't just have
• 6:32
  one big open network. Exactly. If a factory PC
• 6:36
  is on the exact same network as everyone's corporate
• 6:39
  email, a single phished password in HR can halt
• 6:43
  a production line. Here's where it gets really
• 6:45
  interesting to me. The highest value security
• 6:47
  money a physical business can spend isn't on
• 6:50
  some flashy AI cyber defense. It is just the
• 6:53
  unglamorous work of keeping networks apart. It
• 6:56
  is entirely unglamorous. It is tedious architectural
• 6:58
  discipline. You need completely separate authentication
• 7:00
  protocols. But that is the physical firewall
• 7:03
  that keeps the business alive. But even with
• 7:06
  good architecture, you still have to assume the
• 7:08
  network might go down. And this brings up the
• 7:11
  second lesson. When Coca -Cola filed with the
• 7:14
  SEC, they noted the activation of business continuity
• 7:18
  protocols. Which is such a vital phrase. It means
• 7:22
  they had a plan before the attack ever happened.
• 7:25
  Are you saying the ultimate defense against a
• 7:27
  highly sophisticated... digital ransomware attack
• 7:30
  is a literal pencil. I am absolutely saying that.
• 7:34
  We call it paper and pencil continuity. That
• 7:36
  is wild. It forces a brutal examination of your
• 7:38
  business, and the sources highlight this beautifully.
• 7:41
  You have to ask the hard questions. If computers
• 7:43
  die today, can you actually operate? Like, can
• 7:46
  you run the factory blind? Exactly. Can you take
• 7:48
  orders by phone? Can you dispatch trucks using
• 7:52
  printed schedules? Can you sell from the counter
• 7:54
  with just a card machine and a notebook? I imagine
• 7:56
  a lot of modern facilities would just freeze
• 7:58
  up. I mean, they are built on center data and
• 8:01
  predictive algorithms. Totally. And the businesses
• 8:04
  that have actually rehearsed this manual fallback,
• 8:06
  they come out bruised. It hurts financially,
• 8:08
  but they survive. Right. They keep moving. Yeah.
• 8:10
  But the ones that haven't practiced it, they
• 8:12
  just stop dead. Discovering you have no manual
• 8:15
  fallback while staring at a ransom note is a
• 8:17
  catastrophic failure. Wow. OK, so surviving the
• 8:21
  physical shutdown is really only half the battle
• 8:23
  because how a company handles the public narrative.
• 8:27
  dictates their long -term survival right absolutely
• 8:29
  their brand reputation is on the line which brings
• 8:32
  us to the third lesson from the sources proper
• 8:35
  disclosure coca -cola's response here was super
• 8:39
  interesting it was if we connect this to the
• 8:42
  bigger picture coca -cola did something fairly
• 8:44
  rare Within days, they filed that formal document
• 8:48
  plainly stating production was suspended. They
• 8:50
  didn't try to hide it. No, they named the subsidiary.
• 8:53
  They laid out their actions. They said they brought
• 8:55
  in outside cyber experts and notified law enforcement.
• 8:58
  Contrast that with what we usually see. Usually
• 9:01
  a factory goes quiet and the PR department issues
• 9:04
  some vague statement about an IT issue or an
• 9:06
  outage. Right. They hide behind euphemisms. They
• 9:09
  hope they can quietly fix it before a hacker's
• 9:11
  leak site forces their hand. And for you listening,
• 9:14
  this matters so much. Fast, plain disclosure
• 9:17
  isn't just about ticking regulatory boxes. It
• 9:21
  protects the brand. It really does. It allows
• 9:23
  partners in the supply chain to actually plan.
• 9:25
  Exactly. If you are a grocery chain and your
• 9:29
  milk deliveries stop, you need to know why so
• 9:32
  you can adjust. And crucially, plain disclosure.
• 9:36
  takes away the criminal's leverage. That is the
• 9:38
  most important part. Modern ransomware is almost
• 9:41
  always a double extortion scheme now. Because
• 9:43
  they steal the data before they lock the systems.
• 9:45
  Yeah. So their leverage is the threat of publishing
• 9:49
  that sensitive data. If a company tries to hide
• 9:51
  the breach, they are handing the attackers an
• 9:54
  enormous weapon. Because the attackers know the
• 9:56
  company is terrified of the PR disaster. Right.
• 9:59
  But if you've already filed a public document
• 10:01
  with the government saying, hey, we were breached,
• 10:03
  the threat to leak that fact is hollow. The honest
• 10:06
  version of the story told early is almost always
• 10:09
  the cheapest one. That makes total sense. So
• 10:11
  as we look at the fallout of an incident like
• 10:13
  this, the immediate crisis obviously recedes
• 10:16
  eventually. The forensic teams do their thing.
• 10:18
  The milk will flow again and fair life will return
• 10:21
  to the shelves. Right. The physical disruption
• 10:23
  ends. The financial scars will definitely show
• 10:26
  up in the next quarter's numbers. Oh, for sure.
• 10:28
  You have to account for lost production, the
• 10:30
  response costs for those elite cyber teams, and
• 10:33
  just massive amounts of overtime for the internal
• 10:36
  staff. So what does this all mean? The sources
• 10:39
  really detail a massive paradigm shift here.
• 10:42
  Ransomware stopped being just a data privacy
• 10:44
  problem years ago. Totally. It is now a physical
• 10:47
  operations problem. The businesses that survive
• 10:50
  are the ones with segmented networks, rehearsed
• 10:53
  analog fallbacks, and just honest, fast communication.
• 10:57
  That is exactly the takeaway. So I want to ask
• 10:59
  you, the listener, to really consider your own
• 11:01
  workplace or business. Have you mapped out what
• 11:04
  actually separates your office systems from your
• 11:06
  operational ones? Have you answered the could
• 11:09
  we operate without computers question out loud?
• 11:11
  before someone forces you to? It is a question
• 11:14
  every leader needs to ask. And it leaves us with
• 11:16
  a final thought to mull over, building on what
• 11:19
  these sources have shown us. Yeah, lay it on
• 11:21
  us. Think about it. If a billion -dollar, highly
• 11:24
  -resourced brand like Coca -Cola can have its
• 11:26
  physical production abruptly halted by a digital
• 11:29
  intrusion, what does this mean for the fragility
• 11:32
  of our entire just -in -time modern world? It
• 11:35
  is a little unsettling to think about. Right.
• 11:37
  If the invisible bridge between IT and OT can
• 11:39
  literally stop the milk, what other essential
• 11:42
  everyday physical items in our homes and cities
• 11:45
  are quietly sitting just one phished email away
• 11:48
  from grinding to a complete halt?