Mackay Sugar ransomware attack halts Queensland mills (The Gentlemen)

On 10 June 2026, Mackay Sugar, Australia's second-largest raw sugar producer, announced that it was responding to a cyber security incident affecting operations. The attack forced it to halt milling and cane haulage at its Farleigh and Racecourse mills near Mackay in North Queensland, both of which had begun crushing within the previous week. Its third mill, not yet in season, was not affected.

The company said its focus was on staff safety and business continuity. Mackay Sugar processes cane from around 1,300 mainly family-owned farms and produces roughly 700,000 tonnes of raw sugar a year, so the stoppage rippled immediately through growers and the regional supply chain. Canegrowers Mackay noted that rail haulage had fallback measures, while local representatives observed that an outage early in the season was less damaging than one in the middle of the crush.

Attribution and recovery

On 15 June, the The Gentlemen ransomware group, which Microsoft tracks as Storm-2697, named Mackay Sugar on its Tor-based leak site, though no data had been published at that point. By then, one mill had resumed limited manual crushing (from 12 June), and the company reported "significant progress" in restoring the systems supporting cane supply, harvesting and mill operations, with a staged restart of crushing to follow.

Mackay Sugar did not disclose whether industrial control systems were directly hit or whether data had been stolen.

Why it matters

The attack is a clear example of ransomware hitting seasonal agricultural processing, where timing matters: harvested cane must be crushed quickly, so even a few days of IT outage halts work across hundreds of farms. It also shows the reach of The Gentlemen, one of the most prolific ransomware operations of 2026, into the operational backbone of regional economies.