MACKAY Sugar confirmed on 10 June 2026 that a ransomware infection had forced two of its three cane‑processing mills offline just as the crushing season got underway.
The halt threatens the supply chain for refined sugar across eastern Australia and has prompted the firm to call in external incident responders.
The ransomware note left on encrypted systems attributes the intrusion to the group calling itself The Gentlemen.
So far the gang has not posted any exfiltrated data on leak sites, suggesting that negotiations for a decryption key may be under way.
To keep the mills moving, Mackay Sugar has reverted to manual cane weighing and juice flow controls while engineers isolate affected servers.
These work‑arounds have lowered daily throughput by roughly forty percent but have prevented any release of hot liquor or bagasse that could pose a safety hazard.
By 15 June the company said limited crushing had resumed at the Pioneer mill and that forensic teams were rebuilding domain controllers from clean images.
Checks on programmable logic controllers showed no unauthorised firmware changes, though continuous monitoring remains in place.
The incident serves as a reminder that ransomware actors increasingly target seasonal industries where downtime translates directly into revenue loss.
Shared passwords between corporate VPNs and historic SCADA systems can give attackers a quick pivot from IT to OT networks.
Security teams should enforce strict network zoning, disable unnecessary remote desktop protocols on OT devices, and verify that air‑gapped backups are tested at least quarterly.
Additionally, reviewing incident‑response playbooks for ransomware scenarios that include manual operation checklists can reduce recovery time when encryption strikes.