On 10 June 2026, Mackay Sugar, Australia's second-largest raw sugar producer, disclosed a ransomware incident that forced its Queensland milling operations offline days into the 2026 crushing season. The Russian-speaking ransomware-as-a-service operation known as The Gentlemen, tracked by Microsoft as Storm-2697, claimed responsibility on its dark web leak site. Recovery reporting indicates limited manual crushing resumed within roughly 48 hours, but the connected systems that schedule fresh cane intake and haulage stayed down considerably longer, with around 1,300 family farms affected within days. A caveat that governs this entire brief: no victim statement, regulator filing, national CERT advisory or vendor incident report is available in the source set. Every figure below comes from secondary or commentary-tier reporting, and the accounts conflict on basic details.
What Happened
The core sequence is consistent across sources. On 10 June 2026, systems at Mackay Sugar were compromised, milling stopped, and the company reverted to manual operation to protect equipment and salvage cane already cut. SecurityNews reports the company halted its three Queensland mills immediately to prevent the infection spreading, then restarted "limited" crushing at one mill by 12 June. John Zeppos, a resilience practitioner writing on LinkedIn, describes the incident as taking "two of its three mills down." RubyComm and HyperEchos both name the affected sites as the Farleigh and Racecourse mills, with HyperEchos describing a week-long shutdown of two regional mills that have been partially operational since 10 June.
Accounts therefore differ on whether all three mills went dark and one came back, or whether two of three were affected throughout. The distinction matters for anyone modelling blast radius, and no primary source in this set resolves it. What is not in dispute is the operational shape of the event: automated, 24-hour production was replaced by human eyes and paper logs, with personnel mobilised to track logistics by hand against a spoilage clock.
The timing was the aggravating factor. The attack landed days into the crushing season, the point of peak operational dependency. Harvested cane degrades; a remediation lifecycle measured in days or weeks does not align with a crop that has already been cut. HyperEchos quotes grower Charles Townley describing financial losses and uncertainty, with delays potentially pushing harvest into the wetter, less productive part of the season. Australian Sugar Manufacturers CEO Ash Salardini is cited as responding on behalf of the industry.
What Was Taken
Nothing has been confirmed as exfiltrated, and this is the single most important gap in the public record.
HyperEchos reports that cyber security expert Andrew Philp confirmed The Gentlemen claimed the attack on the dark web, but also notes that the group's usual practice of publishing sample data to prove access to the victim environment was not observed in this case. That absence cuts two ways. It may mean the intrusion was disruptive rather than exfiltration-led, or that negotiations were underway, or that a leak-site listing was opportunistic. It may equally mean data was taken and simply never published. Treat any claim of a specific record count as unsupported: none of the eight sources gives one.
This matters for regulatory exposure. Under the OAIC's Notifiable Data Breaches scheme, entities with obligations under APP 11 must assess and, where serious harm is likely, notify affected individuals and the Commissioner. That scheme covers businesses with annual turnover above AUD 3 million, which a producer of this scale plainly exceeds. No NDB notification for this incident appears in the source set, which is consistent with either an assessment concluding no eligible data breach occurred, or with the assessment simply not being public. The Australian Cyber Aware June 2026 roundup logged an uptick in reported incidents across sectors but recorded nothing in its major category for the month, which suggests the incident was not escalated into that publication's top tier.
Why It Matters
This is a clean case study in IT/OT interdependency, and it should be read that way rather than as another ransomware statistic.
Mackay Sugar's mills did not stop because control systems were encrypted. They stopped because cane haulage, harvest scheduling and mill intake are coordinated through connected enterprise systems, and when those froze, the physical supply network froze with them. The plant may have been perfectly capable of crushing; there was no trustworthy way to tell it what to crush. Defenders who have scoped OT risk narrowly around PLCs and historians should note that the scheduling and logistics layer is a production dependency in every practical sense.
The second lesson concerns recovery, and Zeppos frames it well: IT recovery and OT recovery are not the same job. Mackay restarted limited manual crushing in two days, which is genuinely good execution, but the systems required to schedule and intake fresh cane remained down far longer. Boards that treat "systems restored" and "ready to produce" as a single milestone will misread their own recovery time objectives by a wide margin.
Third, timing is now part of the threat model. Risk is not flat across the calendar. Adversaries increasingly select the week the victim can least afford to stop, and for seasonal agri-industry that week is knowable in advance by anyone with a search engine. Harvest windows, quarter-end closes and peak retail periods should be explicit inputs to readiness posture, not background context.
Finally, the manual fallback is the part worth copying. Mackay had an analogue floor to land on. Organisations that have automated away every non-digital path have no such floor, and their downtime is bounded only by restoration speed.
The Attack Technique
The initial access vector at Mackay Sugar has not been publicly established. What follows is The Gentlemen's documented tradecraft generally, per The CISO Brief, and should be treated as a hypothesis for this incident rather than a finding.
The group emerged in mid-2025 out of a payment dispute within the Qilin RaaS program and operates as a human-operated, full-spectrum RaaS outfit. The CISO Brief reports over 500 victims across more than 70 countries by April 2026, concentrated in manufacturing, healthcare and finance; SecurityNews similarly puts the leak-site count above 500 since mid-2025. Reported tradecraft includes targeted exploitation of internet-facing devices, with FortiGate VPNs named specifically, followed by extensive internal reconnaissance. The group's distinguishing capability is operator-maintained EDR and AV killing infrastructure, including at least eight BYOVD driver variants alongside third-party evasion tooling. Lateral movement is reported across 21 distinct methods, with worm-like propagation, and encryption uses hybrid Curve25519/XChaCha20 cryptography across multiple platforms. High-volume data exfiltration typically precedes encryption, which makes the absence of published proof data at Mackay Sugar notable.
The CISO Brief also reports that a May 2026 breach of the group's internal "Rocket" backend exposed operator identities, victim lists and toolchains. The group absorbed this and continued operating with upgraded malware and infrastructure, which is a useful signal about resilience: exposure of a RaaS backend degrades the operation temporarily but does not retire it.
One source in this set, RubyComm, characterises the incident as involving a self-propagating worm bridging enterprise and production networks. RubyComm is an OT security vendor marketing a micro-segmentation appliance, and that characterisation is not corroborated by any other source here. Read it as vendor positioning unless confirmed independently.
What Organizations Should Do
- Map the scheduling and logistics layer as a production dependency. Inventory every enterprise system whose failure stops physical output, including haulage coordination, intake scheduling and dispatch. These are usually classified as IT and funded as IT, and at Mackay they were the failure point.
- Set and test separate RTOs for IT restoration and production readiness. Prove the gap between "systems are back" and "we can accept and process fresh input" with a tabletop or live exercise, then report both numbers to the board as distinct figures.
- Harden and monitor internet-facing edge devices, VPN concentrators first. Given The Gentlemen's reported focus on FortiGate and similar appliances, prioritise patch currency, MFA on all remote access, credential rotation for appliance-local accounts, and alerting on anomalous VPN authentication.
- Assume EDR will be attacked, and instrument for it. Enable and enforce vulnerable-driver blocklists, alert on driver-load anomalies and on agent tamper or service-stop events, and ensure telemetry is forwarded off-host so that killing the agent does not blind you retroactively.
- Enforce segmentation between enterprise and production networks, and verify it empirically. Test whether an attacker with domain credentials can actually reach control-network boundaries. Do this with your own red team or an assessment, not with a vendor's product claim.
- Build and rehearse the analogue fallback. Document manual procedures for your highest-value production path, keep printed or offline copies, and drill the staffing required. Also plan around your own calendar: identify the fortnight in which an outage would be most expensive, and raise monitoring, staffing and patch discipline entering it.
- Pre-stage your regulatory assessment. Under the NDB scheme, know in advance who runs the eligible-data-breach assessment, what the 30-day clock looks like in practice, and what evidence you will need to conclude either way. That work is far harder to start after mills have stopped.
Sources: Breaking Down the Mackay Sugar Mills Cyber Attack: The Gentlemen Ra... | How Did Ransomware Paralyze Australia's Sugar Industry? SecurityNews | When an IT Network Halts a Physical Harvest: The Interdependency Vu... | Mackay Sugar Mills Cyber Attack: Global Ransomware Group The Gentle... | Australian Cyber Aware - As It Was 2606 - June 2026 - Australian Cy... | A ransomware gang stopped Australia’s second-largest sugar producer... | Quick reference guide for responding to data breaches OAIC | The Gentlemen Ransomware: Accelerating Global Attacks with Custom E...