Coca-Cola's Fairlife shutdown moves the resilience question from the conveyor to the ERP

Walk the chain backward from a pallet leaving the dock. An ERP system issues the production order. An MES layer sequences what runs on which line. A scheduling system allocates capacity, an inventory system confirms raw material is available, a quality workflow releases the batch, and a dispatch system routes the finished product out ^[6]. The dev.to post's point is that none of them touches a valve or a conveyor belt directly, and every one of them can still stop output ^[7].

The same post argues that most ransomware coverage treats an incident like this as a story about backup architecture, recovery time objectives and whether the restored data comes back clean ^[10]. Those are restore questions: they measure how fast a system comes back. What stops while a system is gone is a separate measurement.

On the record itself, the post separates six facts Coca-Cola disclosed from two open questions: which dependency stopped the line, and whether the ransomware reached operational technology directly or only the IT systems supporting it ^{[14] [8]}. Cybersecurity Dive and The Register both flagged that same ambiguity about the plant floor ^[3]. Anyone citing Fairlife as a confirmed OT compromise is going past what Coca-Cola has said. Nothing the company has said establishes that plant-floor machinery was encrypted or disabled ^[2].

For this to describe your plant, at least one decision in that chain has to require an online system to authorize it. If quality release exists only as a record created in the QC system, the line can run all shift and produce nothing shippable. When dispatch needs a system-generated document to move a load, finished goods sit in the cooler while the trucks wait. A plant whose supervisors can run a shift off a printed schedule and paper batch records has less exposure here than one whose scheduler is the only place that knows what runs next.

Most OT resilience tests isolate a controller or pull power and confirm the line still turns. The drill that matches this failure mode does the opposite: leave the line energized, take ERP and MES away for a shift, and count the batches released and the loads dispatched without them. The cost is either a shift of degraded output or a mirrored coordination stack, plus a written manual fallback that quality is willing to sign. The post notes that a plant survives a compromised workstation because IT isolates the laptop and production keeps running ^[11]; the case worth rehearsing is the one where, in its words, "The organization hasn't lost any equipment. It's lost the ability to tell that equipment what to do" ^[12].