Mackay Sugar Gentlemen ransomware attack, Australia

On June 10, 2026, Mackay Sugar detected a cybersecurity incident affecting IT systems at its Farleigh and Racecourse mills in North Queensland and directed all cane growers in the region to cease harvesting immediately. Both mills suspended sugar milling and cane haulage at the start of the 2026 crushing season, halting deliveries from over 1,300 family-owned farms. The company engaged specialist incident response personnel and worked with Australian authorities while implementing temporary measures to maintain essential functions. By June 12, a limited manual crushing operation restarted at Farleigh Mill, processing cane harvested before the attack. Steam trials were underway at Farleigh by June 15, with some harvesting expected to resume that week. On June 15 and 16, the Gentlemen ransomware group (tracked by Microsoft as Storm-2697) listed Mackay Sugar on its dark-web leak site and threatened to publish allegedly stolen data within ten days. The company stated it was working to verify those claims. Whether process control systems governing juice extraction, evaporation, or centrifugation were directly encrypted or shut down precautionarily to contain the IT infection remains undisclosed.

Two of three sugar mills fully halted for at least five days at the start of the 2026 crushing season; over 1,300 cane farms unable to deliver harvested sugarcane; Marian mill unaffected. Recovery required steam trials before mill restart. Financial loss and ransom details not disclosed. No safety event or environmental release reported.