In June 2026 an intrusion into Mackay Sugar’s IT stopped two Queensland sugar mills and the harvest feeding them. Within two days one mill was crushing again by hand. The company never said ransomware.
On 10 June 2026 two of Mackay Sugar’s three Queensland mills stopped, by the growers’ account, and growers were told to park their harvesters. A week later the company said it had found unauthorised access “to parts of our IT environment.” No statement from the company, the growers or any government describes a mill control system being touched. That is a silence, not a clearance.
By 12 June Farleigh was running “a limited manual crushing operation” on cane cut before the incident, while “key cane supply and logistics systems” stayed down and no additional cane was accepted. The machinery could turn; getting fresh cane to it could not. BlastWave’s analysis, not a disclosed fact: whatever decides who cuts, which bins go where and what the mill takes next sat close enough to the intrusion to come down with it. The question for any harvest-driven plant is how many days of that roster it could run on paper.
What is not known: Mackay Sugar has not said how the intruder got in, which systems were affected beyond “parts of our IT environment,” or whether anything was encrypted. No statement describes a mill control system being reached: the record is silent, not clear. No cost, lost tonnage or grower loss has been published. On 26 June the company said it was still investigating “the impact on our data”; no finding has been located. Whether data was taken is unresolved.
Recommendation
Separate what gates harvest and intake Cane supply, rail and weighbridge scheduling belong where a business-side intrusion cannot reach them. Whether that separation existed at Mackay Sugar is undisclosed.
Remove credential-based remote access No remote session into business or mill networks on a password alone; bind access to a verified identity and device. The initial vector is undisclosed.
Rehearse the paper path Office systems take mill and intake data over a one-way path, and a paper cane-supply roster is kept current and tried before the first cane is cut.
Sources: Mackay Sugar statements, 10 to 26 Jun 2026 (Updates 2 to 6); Canegrowers Mackay via ABC News, 10 and 12 Jun 2026; The Record, 10 Jun 2026; No ACSC or Queensland government advisory located.. Full list with links.
Soft Spots: Mill control systems: silence, not clearance. Which mills stopped rests on the growers, corroborated by the company’s restart notices. That the cane roster came down with the IT intrusion is BlastWave’s analysis.
The full record
Every claim numbered to its source. Last updated .
An intrusion into Mackay Sugar's IT stopped two Queensland sugar mills and the harvest feeding them, and within two days one mill was crushing again by hand. What is verified, what is only reported, and what is still unknown.
Summary
In June 2026 Mackay Sugar reported a cyber security incident, and by the growers' account two of its three Queensland mills and the harvest feeding them stopped. The company found unauthorized access to "parts of our IT environment" but never said ransomware, and no statement describes a mill control system being reached. All three mills were operational by 26 June.1,2,5,11
Timeline of the Mackay Sugar incident
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Local press publishes the season's crush schedule: Farleigh from 4 June, Racecourse 9 June, Marian 15 June.6
Mackay Sugar says it is responding to "a cyber security incident affecting some of our operations." Canegrowers Mackay says growers received "cease harvesting" notices early that morning and that milling and cane haulage stopped at Farleigh and Racecourse.1,2,14
Update 2: Farleigh has recommenced "a limited manual crushing operation" on cane harvested before the incident; "no additional cane is being accepted at our mills at this stage." The company anticipates "a staged resumption of harvesting and crushing operations across our milling network from next week."3
Update 3: the limited manual crush at Farleigh is complete, steam trials are under way, and systems "that support cane supply, harvesting and mill operations" are being restored. SecurityWeek and Security Affairs report that The Gentlemen listed Mackay Sugar on its leak site that day.4,8,9
Cyber Daily reports the claim and a countdown of about ten days to release allegedly stolen data; a breach-tracking listing dates the listing to 16 June.10,15
Update 4: the company's investigation has found "unauthorised access by an external party to parts of our IT environment," and an external party has made a claim about the company on a dark web site. Recovery plans are unchanged.5
Harvesting and cane rail operations recommence, and Farleigh resumes crushing overnight.12
Update 5 reports the restart. Marian crushing is "planned to commence on Saturday" (20 June); Racecourse is "likely to be early next week."12
Update 6: harvesting and crushing "have commenced at Racecourse Mill" and "All three Mackay Sugar mills are now operational." Experts are still investigating "the impact on our data." The exact day Racecourse restarted is not given.11
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
What did the company report, and when?
"A cyber security incident affecting some of our operations," 10 June 20261
Verified
Which mills stopped?
Farleigh and Racecourse, per Canegrowers Mackay; the company's restart notices corroborate it. Marian had not started its season2,11,12
Under investigation as of 26 June 2026; no finding located11
Undisclosed
What happened at Mackay Sugar in June 2026?
By the growers' account, a cyber incident on 10 June 2026 stopped two of Mackay Sugar's three Queensland mills and the harvest feeding them, in the first week of the crushing season. The company's first statement that Wednesday said only that it was responding to "a cyber security incident affecting some of our operations," with "protecting operational systems" among its priorities.1 It did not say when the intrusion was discovered.
Which mills stopped comes first from the growers' body. Canegrowers Mackay told the ABC that growers received "cease harvesting" advice early that morning and that the incident had "shut down sugar milling and cane haulage across the Farleigh and Racecourse mills."2 It told The Record:
"Mackay Sugar has asked for all harvesting to cease immediately and not resume until further communication comes directly from the company."
Farleigh had begun its season on 4 June and Racecourse on 9 June, so Racecourse had been crushing for about a day; Marian was not due to start until 15 June.6 The company never uses the word "stopped," but its later notices that crushing "recommenced" at Farleigh and "have commenced" at Racecourse corroborate the growers' account.11,12 The ABC describes Mackay Sugar as Australia's second-largest raw sugar producer, with almost 1,300 mainly family-owned supplying farms and about 700,000 tonnes of raw sugar a year.7
Were Mackay Sugar's mill control systems hacked?
No statement from the company, the growers or any government describes a mill control system being reached, and none says one was not. The record is silent, not clear. On 17 June the company described what its investigation had found:
"Our investigation has identified evidence of unauthorised access by an external party to parts of our IT environment."
"Protecting operational systems" appears in the company's statements as a priority, not as a finding.1 On 15 June it said the systems "that support cane supply, harvesting and mill operations" were being restored, without saying which systems those were or how they were affected.4 The accurate summary is that no OT compromise is documented, which is not the same as proof there was none.
Why did the harvest stop if the mill could still crush cane?
Because what stayed down, in the company's words, was "key cane supply and logistics systems," not the mill. Two days into the incident the company said Farleigh had recommenced "a limited manual crushing operation," processing cane harvested before the incident, and in the same statement:3
"key cane supply and logistics systems remain subject to ongoing restoration and no additional cane is being accepted at our mills at this stage."
On 15 June the company reported: "We have completed a successful limited manual crushing operation at Farleigh Mill, processing cane harvested prior to the incident."4 The manual crush was real and it was small: one mill, cane already cut, no new cane taken. It is the best evidence that the mill process itself stayed runnable, not a measure of how badly the mill was hit.
A second fallback rests on one account. The growers' chairman told the ABC on 10 June:
"For trains on the tracks, they have fallback measures to get them back to the factories, and they're doing that."
The company never described that fallback itself. Why the harvest had to stop with the intake is BlastWave's analysis rather than a disclosed fact: cut cane has to reach a mill quickly, so without the systems that schedule it, cutting more cane had nowhere to go. The cost to growers was plain to their chairman: "When we are not harvesting, there's no money coming in obviously."16
Was it ransomware, and who was behind it?
Mackay Sugar never said ransomware and never said anything was encrypted, in any of its six statements from 10 to 26 June 2026.1,3,4,5,11,12 On day one, The Record noted the gap directly:
"The company did not disclose the nature of the cyberattack, whether any data had been compromised or whether ransomware or another form of malicious activity was involved."
The word arrived with a leak-site claim. SecurityWeek and Security Affairs reported that a group calling itself The Gentlemen listed Mackay Sugar on its leak site on 15 June; Cyber Daily reported the claim on 16 June without dating the listing, and a breach-tracking listing gives 16 June.8,9,10,15 The accurate wording is "claimed by The Gentlemen." On 17 June the company confirmed only that "an external party has made a claim about our company on a dark web site" and that it was "working urgently to verify these claims," adding that the development "has not changed our operational recovery plans."5
No government, including the Australian Cyber Security Centre, has attributed the incident in anything located for this entry, as of late September 2026.17,18 Press reports that Microsoft tracks The Gentlemen as Storm-2697 describe the group, not a finding about this intrusion, and the ABC's description of the group as "Russian-speaking" is not a national attribution.8,19 The company says it "reported the incident to the appropriate authorities."3
When did Mackay Sugar's mills restart?
All three mills were operational by 26 June 2026, by the company's own account, but it never gave a single restart day for the district. On 19 June it said it had "recommenced harvesting operations and cane rail operations yesterday and crushing recommenced at Farleigh Mill overnight," with Marian "planned to commence on Saturday" and Racecourse "likely to be early next week."12
On 26 June it said harvesting and crushing "have commenced at Racecourse Mill" and "All three Mackay Sugar mills are now operational."11 It did not give Racecourse's exact day. The same update said its experts were still investigating "the impact on our data" and would share findings only once they were "accurate and verified."11 No finding has been located.
What is still not known about Mackay Sugar
How the intruder got in.
Which systems were affected beyond "parts of our IT environment."5
Whether anything was encrypted. The company has not said.
Whether any mill control system was reached. The record is silent, not clear.
Whether data was taken. On 26 June the company said it was still investigating "the impact on our data"; no finding had been located as of late September 2026.11
Whether the leak-site claim was followed by a leak. Cyber Daily reported a countdown of about ten days; no publication of data was located in searches in late September 2026.15
The exact day Racecourse restarted, after 19 June and by 26 June.11,12
The incident's cost, lost tonnage and grower losses. None has been published; the annual report for the year ended 28 February 2026 carries no cyber reference.13
Claims about Mackay Sugar the record does not support
Widely repeated claim
What the record says
"Mackay Sugar was hit by a ransomware attack."
The company never said ransomware or encryption in any of its six statements. The word comes from a leak-site claim, reported by the press, that the company acknowledged but did not confirm.5,8,11
"Mackay Sugar was forced to begin manual crushing."
The company offered the "limited manual crushing operation" as its first good news: one mill, cane harvested before the incident, no additional cane accepted. It shows the process was runnable; it is not a measure of the damage.3,4
"Mackay Sugar produces 700,000 tonnes of cane a year."
About 700,000 tonnes is raw sugar, per the ABC. The 2025 season crush was 4,759,401 tonnes of cane, per the company's annual report.7,13,16
BlastWave analysis: the mill could still turn
Analysis, not a disclosed fact
Mackay Sugar sits at the rung of the consequence ladder where an IT compromise halts physical operations, and then degrades rather than stops them. The machinery could turn: the company told us so first, before any restart, with a limited manual crush on cane already cut.3 What it could not do was take the next load. BlastWave's analysis, not a disclosed fact: whatever decides who cuts, which bins go where and what the mill takes next sat close enough to the intrusion that it came down with it. The company never said which systems depended on which.
That is the fallback-capacity argument in one incident. A manual path existed. It was real, and it was small: cane already on the pad and, by the growers' chairman's account, fallback measures for cane trains already on the tracks.2,4 The question for any harvest-driven plant is how many days of its intake roster it could run on paper.
Podcast: “The Thin Edition” (9:12). Joe Baxter and Cam Cullen on why the mill could still turn by hand while the harvest stopped anyway.
Video: Mackay Sugar Short (60 to 90 seconds).
Frequently asked questions
What happened in the Mackay Sugar cyber attack?
On 10 June 2026 Mackay Sugar said it was responding to a cyber security incident affecting some of its operations. According to the growers' body, Canegrowers Mackay, milling and cane haulage stopped at the Farleigh and Racecourse mills and growers were told to stop harvesting. On 17 June the company said its investigation had found evidence of unauthorized access by an external party to parts of its IT environment. It said all three mills were operational by 26 June.
Was the Mackay Sugar incident ransomware?
Mackay Sugar never used the word ransomware and never said anything was encrypted in any of its six statements between 10 and 26 June 2026. The ransomware label comes from a claim by a group calling itself The Gentlemen on its leak site, reported by the press in mid-June. The company acknowledged that a claim had been made on a dark web site and said it was working to verify it.
Who was behind the Mackay Sugar cyber attack?
A group calling itself The Gentlemen claimed the incident on its leak site, listed on 15 or 16 June 2026 depending on the report. Mackay Sugar confirmed only that an external party had made a claim about it on a dark web site and named no one. No government attribution, including from the Australian Cyber Security Centre, had been located as of late September 2026.
Were Mackay Sugar's mill control systems hacked?
No statement from Mackay Sugar, the growers or any government describes a mill control system being reached, and none says one was not. On 17 June 2026 the company said the unauthorized access was to parts of its IT environment. The record is silent on the mills' control systems rather than clear, so neither a compromise nor its absence has been shown.
Why did Mackay Sugar crush cane manually?
On 12 June 2026 Mackay Sugar said Farleigh had recommenced a limited manual crushing operation on cane harvested before the incident, while key cane supply and logistics systems were still being restored and no additional cane was accepted. It reported the manual crush complete on 15 June. The mill could run by hand; what stopped was the business of bringing in new cane.
When did Mackay Sugar's mills restart?
Mackay Sugar said on 19 June 2026 that harvesting and cane rail had restarted the day before and that Farleigh resumed crushing overnight, with Marian planned for Saturday 20 June. On 26 June it said Racecourse had commenced and all three mills were operational. The company did not give the exact day Racecourse restarted.
How much did the Mackay Sugar cyber incident cost?
The cost is undisclosed. As of late September 2026 Mackay Sugar had published no cost, lost tonnage or grower loss figure, and its annual report for the year ended 28 February 2026 carries no cyber reference. The growers' chairman, Joseph Borg, told Queensland Country Life in June 2026 that when growers are not harvesting there is no money coming in.
Primary sources are Mackay Sugar's own six dated statements and its annual report. The growers' body, the leak-site claim and all other reporting reach this page through the press, which is cited only as evidence of what was said.
CompanyMackay Sugar, "Mackay Sugar Cyber Security Incident," 10 June 2026. Also posted to the company's Facebook page the same day. mkysugar.com.au
PressABC News, report quoting Canegrowers Mackay chairman Joseph Borg, 10 June 2026. Cited as evidence of what was said. abc.net.au
PressMackay and Whitsunday Life, "Rollers moving for 2026 crush!", 5 June 2026 (published crush schedule: Farleigh 4 June, Racecourse 9 June, Marian 15 June; company crop estimate 5.1 million tonnes). Cited as evidence of what was said. mackayandwhitsundaylife.com
PressABC News, report on the planned reopening, with company scale figures and comment from Joseph Borg, 12 June 2026. Cited as evidence of what was said. abc.net.au
PressSecurityWeek (Kovacs), report on the leak-site listing by The Gentlemen, 15 June 2026. Cited as evidence of what was said. securityweek.com
PressSecurity Affairs, report on the leak-site listing by The Gentlemen, 15 June 2026. Cited as evidence of what was said. securityaffairs.com
PressBreachsense, breach-tracking listing for Mackay Sugar (listing dated 16 June 2026). Cited as evidence of what was said. breachsense.com
Company filingMackay Sugar Limited, Annual Report 2025/26, year ended 28 February 2026 (2025 season crush of 4,759,401 tonnes of cane; Nordzucker shareholding 70.9%). Carries no cyber reference. PDF · Shareholders page
PressThe Record (Recorded Future News), report quoting Canegrowers Mackay, 10 June 2026. Cited as evidence of what was said. therecord.media
PressCyber Daily (Daniel Croft), report on the claim by The Gentlemen and its countdown, 16 June 2026. Cited as evidence of what was said. cyberdaily.au
PressQueensland Country Life (Celia Freeman), report quoting Joseph Borg, 17 June 2026. Cited as evidence of what was said. queenslandcountrylife.com.au
PressThe Register (Connor Jones), report on the incident and the claim, 17 June 2026. Cited as evidence of what was said. theregister.com
PressThe Record (Recorded Future News), report on the restoration and the claim by The Gentlemen, 18 June 2026. Cited as evidence of what was said. therecord.media
PressABC News, report on the claim by The Gentlemen, 18 June 2026. Cited as evidence of what was said. abc.net.au
Cite this page
BlastWave. “Mackay Sugar Cyber Incident (2026): What Is Verified.” Hackopedia, Volume 2, FILE 038. Last verified 28 September 2026. https://hackopedia.blastwave.com/food-beverage-retail/mackay-sugar-2026/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 038 in Hackopedia Volume 2, in the Food, Beverage and Retail edition.
28 Sep 2026
Hand-check and final consistency review. The Queensland Country Life report is now dated 17 June 2026, the date its page carries, rather than 10 June; its figure of 700,000 tonnes "of cane" was confirmed as a noun error. The entry was checked against the JBS, Asahi and Port of Nagoya entries.
26 Sep 2026
Full validation. All six company statements were read in full on the company's own site, including the 12 June statement, earlier read only as quoted by the press. The finding that the company never said ransomware now covers all six statements. The restart is now dated by the company's 19 and 26 June updates (all three mills operational by 26 June) rather than shown as undisclosed, and the open data investigation was added.
24 Sep 2026
Volume 2 entry built from primary sources: the company's dated statements, its annual report, and the growers' body as reported by ABC News and The Record. This incident has no Volume 1 entry.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
