The Gentlemen ransomware group struck Mackay Sugar on June 10, forcing closure of two of three mills and triggering “cease harvesting” orders to roughly 1,300 North Queensland family farms. One mill resumed limited manual operations by June 12, but critical scheduling and logistics systems remained compromised. The attack highlights ransomware’s shift toward targeting time-sensitive food production and shows how private regional facilities function as critical infrastructure.
Ransomware Forces Closure of Two Mackay Sugar Mills During Critical Harvest
Image: Mackay Sugar
When attackers want maximum leverage they target what communities cannot go without. That is exactly what unfolded when the ransomware group known as the Gentlemen struck Mackay Sugar, forcing the company to close two of its three mills in the middle of harvest season.
The intrusion, first detected on June 10, did more than encrypt files: it halted cane-crushing operations, stopped rail movements and prompted “cease harvesting” directives to about 1,300 family farms across North Queensland. The outage created a sudden operational blackout for a regional economy that depends on precise seasonal timing.
Sugar cane is perishable, and delays in processing quickly reduce sugar content and farmers’ revenue. Mackay Sugar, Australia’s second-largest raw sugar producer, said it had restarted limited manual operations at one mill by June 12, but its advanced scheduling and logistics systems remained compromised.
Joseph Borg, Canegrowers Mackay: “Don’t expect a quick turnaround.”
The Gentlemen group, tracked by Microsoft as Storm-2697, is known for rapid propagation and disruptive tactics. Their malware displays worm-like lateral movement across networks. Mackay Sugar has not confirmed whether industrial control systems were directly breached or whether attackers confined the disruption to IT systems that coordinate production, but either outcome halted mill operations.
Why This Matters
This incident underscores a troubling trend: ransomware actors increasingly target food and agricultural infrastructure—meat processors, grain handlers and now sugar mills—because those industries cannot tolerate downtime. By exploiting that vulnerability, attackers can extract outsized leverage and financial gain.
More broadly, the Mackay outage highlights how privately owned regional facilities function as critical infrastructure. Disruption to a single mill network instantly impacts thousands of workers, growers and families who rely on timely seasonal processing. It also exposes the often-invisible digital backbone—scheduling, logistics and surveillance systems—that keeps everyday staples flowing to consumers.
Next Steps For The Sector
While details of the breach remain under investigation, the episode reinforces key defensive priorities for agriculture and industrial operators: network segmentation, reliable offline backups, incident response planning, and rapid communication with suppliers and growers to limit downstream damage.
Help us improve.
