Ransomware · 88 days ago
The outage is now also a data-theft verification problem. Mackay Sugar says it found evidence that an outside party reached parts of its IT environment, so the work is no longer just restoring mills and harvesting systems but checking whether anything was copied and could be published.
On day 3, the company said it was reviewing the Gentlemen group’s public leak claim and trying to confirm what, if anything, was accessed. The attack already shut two mills on June 10 and slowed harvesting across Queensland’s Mackay region, but the new issue is that a recovery-only response can miss the disclosure risk if data already left the network.
Gentlemen says it will post allegedly stolen data if it is not paid. That turns the incident into a live extortion case, with operational recovery now tied to forensic validation and the chance of public release.
4 sources covering this story
The Record from Recorded Future
Australian sugar producer works to restore operations as ransomware group claims attack
Mackay Sugar said it was "working urgently" to verify claims that a highly active ransomware group was behind a cyberattack that shut down harvesting and milling operations.
Cyberattack sees crops kept in the ground
Bitter harvest for Australia's Mackay Sugar, attacked in peak cane crushing season
Ransomware Attack Shuts Down Mills of Australia’s Second-Largest Sugar Producer
Mackay Sugar was targeted in a cyberattack carried out by a threat group known as The Gentlemen.
Cyberattack disrupts Mackay Sugar operations, highlighting escalating cyber threats to agri-industrial production and logistics.
The Record from Recorded Future
Cyberattack shuts down major Australian sugar mills, disrupting harvest
Australia's second-largest sugar producer said on Wednesday that it was responding to a cybersecurity incident affecting parts of its operations and had engaged cybersecurity experts and local authorities to investigate the attack and restore its systems safely.
Part of the PlainSec briefing for 2026-06-16