Mackay Sugar cyberattack halts two Queensland mills; all three operational by 26 June
A cyberattack halted normal operations at Mackay Sugar’s Farleigh and Racecourse mills, disrupting growers. All three mills were operational by 26 June, but the data investigation remained open. No household software update is required.
Nothing for you to do on a household device: this affected Mackay Sugar’s business systems. Employees, growers and contractors should follow the company’s direct updates and contact it about any personal-information concerns.
What’s happening
Mackay Sugar disclosed a cyberattack on 10 June that halted normal operations at its Farleigh and Racecourse mills in Queensland. ABC reported that many of the approximately 1,300 farms supplying the company paused harvesting. Farleigh initially processed previously harvested cane manually while supply and logistics systems were restored. The Gentlemen ransomware group claimed responsibility, according to SecurityWeek and ABC, but ABC said attribution could not be independently verified. Mackay Sugar confirmed unauthorised access to parts of its IT environment and investigated the claim. Harvesting and cane rail operations restarted on 18 June, followed by crushing at Farleigh. By 26 June, all three mills were operational, including Racecourse and Marian. The company was still investigating the impact on its data. No newer public outcome was found through 3 November, leaving the extent of any information theft and final attribution unconfirmed.
- What
- Breach
- Affects
- Mackay Sugar’s business systems and Queensland mill operations
- Fixed in
- Nothing to patch
- Since
- 10 June 2026
- Closed
- 26 June 2026
Timeline
- Update
Mackay Sugar confirmed that Racecourse had restarted and all three mills were operational. Specialists were still investigating the incident and its impact on company data.
- Update
Mackay Sugar said harvesting and cane rail operations had restarted the previous day, with crushing resuming at Farleigh overnight. Racecourse was still awaiting restoration and validation of key systems.
- Update
Mackay Sugar confirmed evidence of unauthorised access to parts of its IT environment. It was investigating an external party’s claim and whether information had been accessed.
- Update
SecurityWeek reported that The Gentlemen ransomware group had claimed Mackay Sugar as a victim that day, without publishing data. The report said it was unclear whether industrial control systems had been compromised.
- Update
Farleigh Mill resumed limited manual crushing to process cane harvested before the incident. Cane supply and logistics systems were still being restored, and the mills were accepting no additional cane.
- Made publicNothing to patch
Mackay Sugar disclosed a cyber incident affecting its operations. It engaged cyber security specialists, introduced interim business processes and began communicating with employees, growers and partners.
Sources
- Mackay Sugar Cyber Security IncidentMackay Sugar · 10 June 2026
- Mackay Sugar Cyber Security Incident Update 2Mackay Sugar · 12 June 2026
- Mackay Sugar Cyber Security Incident Update 4Mackay Sugar · 17 June 2026
- Mackay Sugar Cyber Security Incident Update 5Mackay Sugar · 19 June 2026
- Mackay Sugar Cyber Security Incident Update 6Mackay Sugar · 26 June 2026
- Global ransomware group reportedly claim cyber attack that shut down Mackay Sugar millsABC News · 18 June 2026
- Ransomware Attack Shuts Down Mills of Australia’s Second-Largest Sugar ProducerSecurityWeek · 15 June 2026