Coca-Cola suspended US production of its fairlife dairy brand after its systems were hit by ransomware. In a statement, the company said it had detected unauthorized access to part of its infrastructure, including production systems. Lines came to a halt while technicians investigated the incident.

At first glance, this looks like yet another incident in a long series. But one detail makes it especially relevant for those working with on-prem AI infrastructure: the blow didn’t land on a marketing database or a shared cloud platform, but on machinery and software that govern physical processes, hosted locally, under the full control of the company. That same logic applies to many GPU clusters running LLM inference outside major clouds: owned hardware, data and models kept in-house, direct security management.

The fairlife attack shows with brutal clarity that managing everything in-house can become a trap unless an adequate defense posture is built. When ransomware encrypts the servers that orchestrate an inference cluster – or worse, the storage nodes where model checkpoints live – operations grind to a halt, just like a dairy plant. The damage isn’t just temporary service loss: it’s the paralysis of assets that required significant investments in specialized hardware and cannot be restored with a simple failover to a backup cloud instance.

The implications go beyond the single case. For an organization that embraces self-hosted AI for data sovereignty or TCO reasons, the attack surface expands if environments aren’t segmented with the same care used to pick a model or tune quantization. An inference unit that talks to industrial automation networks or to databases holding sensitive data must be treated like a control room: immutable backups, continuous security updates, response plans that include hot-swapping compromised nodes.

There’s also a little-discussed market angle. Cyber insurance policies are starting to differentiate between generic IT infrastructure and critical AI workloads. An on-prem cluster worth hundreds of thousands of euros becomes a concentrated risk that can drive up premiums or impose strict clauses. The alternative – delegating security to a cloud provider – doesn’t eliminate the problem, but shifts it to a contractual plane: who responds to an incident and how fast? The question will grow as fine-tuning and inference on proprietary data move toward hybrid setups, where the model lives on-prem but the management plane is exposed to the internet.

The fairlife case signals a structural awareness: on-prem AI infrastructure is now a target for cybercrime, no different from production systems. Those who choose this path must budget for security investments comparable to their hardware spend, or accept that full data control comes with a higher price tag than expected.

Those evaluating on-prem deployments can find analytical frameworks on AI-RADAR to weigh these trade-offs, without shortcuts.