North Queensland Cyber Watch: ransomware halts a major Queensland sugar mill

This is the second entry in North Queensland Cyber Watch, an ongoing series looking at cyber security incidents affecting our region and what organisations here can take from them. The intent of this series isn’t to alarm anyone or pile on an organisation already having a bad week. It’s to turn each incident into a practical prompt: could this happen to us, and are we ready if it did?

What was reported

In June 2026, Mackay Sugar confirmed it was responding to a cyber security incident affecting some of its operations, disrupting crushing right in the middle of peak season. Further reporting on the wider impact is available via IDM.net.au and, though it names the affected operator differently, via Veri Sızıntısı, a cyber threat intelligence blog covering the same incident.

Mackay Sugar’s own notice is deliberately brief — confirming the incident, that specialist cyber security experts and authorities were engaged, and that interim processes were put in place for critical business functions, without detailing which systems were affected or how. The broader operational impact described below comes from the secondary reporting above, so treat those specifics as reported rather than officially confirmed.

By the accounts available:

• Crushing was halted at two mills during peak season, forcing roughly 1,300 family-owned cane farms to stop harvesting.
• Cut cane loses sugar content quickly, so the shutdown put grower income at direct risk, not just the mill’s own operations.
• A ransomware group calling itself The Gentlemen claimed responsibility and listed the company on its dark web leak site with a countdown timer, though no stolen data had been published at the time of reporting.
• Limited manual crushing reportedly resumed at one mill within days while the company brought in external cyber security specialists and notified authorities.
• The Food and Ag-ISAC has documented over 265 ransomware attacks against the agriculture and food sector globally in 2025 alone, and Australia’s critical infrastructure incidents are reported to be up 82% year on year.

Why this matters beyond the mill gate

This is a textbook example of an availability attack — in CIA Triad terms, the mill’s systems were made unreachable, not necessarily exposed or altered (see our companion piece on the CIA Triad for more on that framework). But the consequences ran straight through the supply chain: a mill’s IT outage became a farmer’s income problem within days, because operational technology and IT are now inseparable in agriculture.

North Queensland’s economy leans heavily on exactly this kind of critical infrastructure — sugar, cane, mining services, ports and agriculture generally. None of it is too regional or too unglamorous to be a target. Ransomware groups don’t discriminate by postcode; they look for exploitable access and a business that can’t afford downtime, and a mill mid-crush is about as time-pressured as an operation gets.

What organisations in similar positions can take from it

• Map what “downtime” actually costs you, in hours, not just dollars. For a mill mid-crush, hours matter more than most office environments realise about their own operations.
• Separate IT and operational technology networks where possible, so a compromise on one side doesn’t automatically take down the other.
• Test backups by actually restoring them, not just confirming a backup job completed.
• Have an incident response plan that names decision-makers, not just an IT contact — who talks to growers, customers, media and regulators while systems are down matters as much as the technical recovery.
• Assume you are in scope. Regional and agricultural operators are not a niche target; they are increasingly a preferred one, precisely because downtime is so costly and patching cycles can lag behind less operationally sensitive industries.

If your organisation depends on operational technology, critical infrastructure, or simply can’t afford extended downtime, Suburban Secure’s managed IT services and network security services are built around exactly this kind of readiness conversation, including for operators around Mackay, Townsville and Rockhampton.

Being ready doesn’t mean expecting the worst. It means not being surprised by it.