Lead

Mackay Sugar, one of Australia's largest sugar producers, has said it hopes to resume production next week after a cyber attack forced the shutdown of two of its three mills in north Queensland. The company, which processes about 700,000 tonnes of raw sugar annually, has been working with cybersecurity experts and authorities to investigate the incident and restore systems.

Coverage Comparison

Initial reports from the Australian Broadcasting Corporation (ABC) on Wednesday indicated that a "cyber security incident" had halted sugar milling and cane haulage at the Farleigh and Racecourse mills, just outside Mackay. Those reports, citing an advocacy group for sugarcane growers, said the shutdown affected multiple parts of the business. Subsequent reporting from the ABC noted that Mackay Sugar had shut down the two mills early Wednesday morning after discovering operating systems had been compromised.

Later reporting from the same outlet said the company had recommenced limited manual crushing at the Farleigh Mill to process cane that had been harvested before the attack, and that both mills had run steam trials in preparation for a staged restart. The company's statement said it was "progressively restoring critical systems" and anticipated a "staged resumption" of operations from next week.

Three separate reports from the ABC, all drawing on company statements and interviews, consistently described the event as a cybersecurity incident or attack. None of the reports presented conflicting accounts of the basic facts, though the latest reporting added the unverified claim of responsibility by a ransomware group.

Key Claims

  • Mackay Sugar shut down two of its three mills — Farleigh and Racecourse — early Wednesday after detecting compromised operating systems, according to company statements reported by the ABC.
  • The company anticipates a staged resumption of harvesting and crushing operations from next week, as stated in its release.
  • Specialist cybersecurity experts are working alongside company teams and relevant authorities to investigate and safely restore systems, per the company's statement.
  • Mackay Sugar has reported the incident to authorities, as stated in its release.
  • Limited manual crushing has recommenced at the Farleigh Mill to process already-harvested cane, per company statements. Sugar cane must be processed within a set period after harvesting to preserve sugar content, as explained in the reporting.
  • A Russian-speaking ransomware operation known as The Gentlemen has claimed responsibility for the attack on the dark web, but this claim has not been independently verified, according to cybersecurity expert Andrew Philp, who was quoted in the ABC's reporting.

Perspectives

Company perspective

Mackay Sugar has emphasized its focus on staff safety, business continuity, and supporting growers. The company has said it is working urgently to verify external claims about the incident and is doing everything it can to safely resume full operations as soon as possible.

Grower perspective

Growers in the Mackay region have expressed concern about the delay. Tony Bugeja, a second-generation cane farmer, said he was due to start harvesting on Thursday and worried about losing at least a week, noting the importance of early harvesting to take advantage of high sugar levels. The Canegrowers Mackay chairman, Joseph Borg, said growers were issued with "cease harvesting" advice early Wednesday morning.

Cybersecurity expert perspective

Andrew Philp, from Australian cybersecurity advisory firm Trend AI, said that while The Gentlemen made the claim on a dark web site, there was minimal evidence to prove it true unless authorities or Mackay Sugar confirmed it themselves. He noted that typical ransomware groups publish a sample of data to prove access, but in this case, researchers did not see such evidence. The Queensland Police Service and the Australian Federal Police declined to comment.

Additional Context

The Gentlemen is described by cybersecurity researchers as a Russian-speaking ransomware-as-a-service operation that emerged last year. A report by Check Point Research cited in the ABC's coverage said The Gentlemen had claimed attacks on 320 targets as of April, with the actual number of victims estimated at around 1,570. Australia was listed as the fourth-most-targeted nation. These details come from a single report and have not been independently confirmed in the coverage reviewed.

Mackay Sugar is Australia's second-largest raw sugar producer, with nearly 1,300 mainly family-owned farms supplying its three mills. The company's third mill was due to start crushing next week and was not affected by the incident.