# Ransomware Attack Paralyzes Australia's Second-Largest Sugar Producer—The Gentlemen Claim Mackay Sugar


As The Gentlemen threat group escalates attacks against critical agricultural infrastructure, Mackay Sugar fights to restore operations while uncertainty lingers over data theft and OT system compromise


## The Threat


Mackay Sugar, Australia's second-largest raw sugar producer, became the latest victim of an industrial-scale ransomware operation when The Gentlemen threat group targeted its Queensland-based operations on June 10, 2026. The attack forced the company to suspend operations across two of its three cane-processing mills, disrupting one of Australia's most critical agricultural supply chains and affecting thousands of cane growers who depend on the company for harvest processing.


The incident came to light when Mackay Sugar announced it was responding to a "cybersecurity incident affecting some of its operations." In the days that followed, the company disclosed the scope of the attack: critical cane supply, logistics, and mill operation systems were compromised, forcing the company to halt acceptance of harvested sugarcane and suspend normal crushing operations. By June 12, Mackay Sugar had resumed limited manual crushing at one mill to process cane harvested before the attack, but key systems remained offline. As of June 15—five days into the incident—the company confirmed it was still in active response mode, though "significant progress" had been made restoring cane supply, harvesting, and mill operation systems.


On the same day Mackay Sugar provided its latest status update, The Gentlemen ransomware group claimed the company as a victim, posting Mackay Sugar's name on its Tor-based leak website. However, the group has not yet released stolen data—a critical detail that leaves open questions about whether attackers successfully exfiltrated sensitive information during their time inside the company's network.


## Background and Context


### Mackay Sugar's Role in Australia's Agricultural Sector


Mackay Sugar is not merely another mid-market company—it is a cornerstone of Australia's sugar industry. Operating three cane-processing mills in the Mackay region of Queensland, the company processes raw sugarcane from thousands of independent growers across a vast agricultural region. As Australia's second-largest raw sugar producer, it plays an outsized role in the national economy and global sugar markets. Any disruption to Mackay Sugar's operations cascades across the agricultural supply chain: growers cannot harvest cane, brokers cannot arrange transport, and mills cannot process inventory.


The agricultural sector has increasingly become a target for ransomware groups, as farms and processors depend on complex supply chain and operational technology systems that are often less mature in their cybersecurity practices than technology-native industries. Ransomware attacks against agricultural companies create a unique form of leverage: crops cannot wait, harvests have finite windows, and operational losses compound rapidly.


### The Gentlemen: A Rising Ransomware Threat


The Gentlemen (tracked by Microsoft as Storm-2697) emerged in mid-2025 and has rapidly accumulated an impressive roster of victims. The group's Tor website lists more than 500 alleged victims at the time of writing, placing them among the more prolific ransomware operations globally. What distinguishes The Gentlemen from many competing ransomware groups is not just their victim count, but their operational sophistication.


The cybercriminals operate a classic double-extortion model: they deploy malware to encrypt files on compromised systems while simultaneously exfiltrating data. The encryption holds systems hostage until the victim pays a ransom, while the threat of data publication provides additional pressure. However, The Gentlemen's malware has drawn particular attention from security researchers for its worm-like lateral movement capabilities—meaning the malware can autonomously propagate across networks, jumping from one system to the next without requiring the attackers to manually conduct each step of lateral movement. This capability dramatically accelerates how quickly an attacker can spread their foothold from an initial compromise into widespread network control.


## Technical Details and Attack Progression


### Initial Compromise and Lateral Movement


While Mackay Sugar has not disclosed the specific attack vector, the incident follows a pattern consistent with The Gentlemen's operational approach. Initial compromises typically occur through:


  • Credential theft (phishing, password reuse, compromised credentials on dark web marketplaces)
  • Unpatched vulnerabilities in externally facing systems (VPNs, web applications, remote access systems)
  • Supply chain compromise (trojanized software updates or compromised third-party vendors)

    • Once inside, The Gentlemen's malware begins its lateral movement campaign. Unlike ransomware operations that require human attackers to manually move through a network using tools like Mimikatz or PsExec, The Gentlemen's worm-like capabilities allow the malware to autonomously spread, compromising systems at scale and dramatically reducing the time from initial access to widespread encryption.


    ### The Operational Technology Question


    A critical unknown in this incident is whether The Gentlemen obtained access to operational technology (OT) systems—the specialized hardware and software that control industrial processes like milling machinery, temperature and pressure monitoring, and conveyor systems. The Mackay Sugar incident description focuses on IT systems: cane supply, harvesting logistics, and business operations platforms.


    However, ransomware groups have increasingly targeted OT systems, where:

  • Disconnection from the Internet creates the perception of security, but modern industrial systems often integrate with IT networks
  • Downtime is measured not in hours lost productivity, but in ruined crops and supply chain chaos
  • Organizations prioritize business continuity over forensic analysis, making payment more likely

    • If The Gentlemen accessed Mackay Sugar's OT environment, the attack's impact—and the company's pressure to pay—would be substantially amplified.


    ## Impact and Implications


    ### Supply Chain Disruption


    The suspension of crushing operations at two mills creates immediate cascading damage:


    | Stakeholder | Impact |

    |---|---|

    | Growers | Cannot harvest cane; harvested cane cannot be processed; crops risk degradation |

    | Harvesters | Equipment sits idle; revenue stops until operations resume |

    | Logistics providers | Trucks arranged for cane transport are canceled; revenue interrupted |

    | Sugar market | Supply tightens; global prices may shift; Australia's sugar export revenues at risk |

    | Employees | Mackay Sugar workforce is furloughed or performing manual workarounds |


    ### Attacker Leverage and Ransom Pressure


    Mackay Sugar faces a devastating negotiating position. Unlike technology companies, which can absorb months of downtime while restoring from backups, agricultural businesses operate on crop timelines measured in days. Cane degrades in quality if left unharvested; harvesters lose money with each passing day; growers accumulate inventory they cannot sell. The Gentlemen understand this dynamic fully, and it is precisely why they target agricultural infrastructure.


    The fact that The Gentlemen has not yet published data is strategically significant. The group may be withholding the leak as additional pressure—claiming they have sensitive data (customer information, financial records, or operational details about agricultural suppliers) to convince Mackay Sugar that payment is necessary even if the company manages to restore encrypted systems through backups.


    ### Sector-Wide Implications


    This attack is the third major incident targeting agricultural critical infrastructure in six months. Other recent incidents include ransomware against grain elevators, dairy processing facilities, and agricultural equipment manufacturers. Ransomware groups are systematically discovering that agriculture represents a sector where:

  • Organizations are digitizing operations faster than they are maturing their security
  • Downtime tolerance is near-zero
  • Insurance companies are eager to pay ransom to prevent catastrophic crop losses
  • Infrastructure is often regional, making the targeting highly visible and disruptive

    • ## Restoration Efforts and Remaining Risks


    Mackay Sugar's response has been measured and deliberate. The company suspended all operations rather than risk spreading the malware further. Manual crushing operations resumed June 12 at one mill, processing only pre-incident cane, while systems restoration continued in the background. By June 15, the company reported steam trials were underway and some harvesting was expected to resume "later this week" pending system validation.


    However, Mackay Sugar's cautious approach indicates the company recognizes significant risks:


    1. Incomplete visibility into compromise scope – the company may not yet know the full extent of systems affected

    2. OT system integration uncertainty – validating that industrial systems are not corrupted requires thorough testing

    3. Data exfiltration assessment – forensics to determine what information was stolen are ongoing

    4. Backup integrity – ransomware that has worm-like propagation capabilities may have compromised backup systems before encryption occurred


    ## Recommendations for Defenders


    Organizations in agriculture, manufacturing, and other critical sectors should treat this incident as a wake-up call:


    Immediate actions:

  • Conduct vulnerability scans on externally facing systems, particularly VPNs and remote access portals
  • Review credentials logs for anomalous access patterns in the past 6 months
  • Isolate OT networks from IT networks at the architectural level
  • Test backup restoration procedures offline (not connected to production systems)

    • Strategic measures:

  • Implement network segmentation so lateral movement is costly and detectable
  • Deploy EDR (endpoint detection and response) tools to catch worm-like malware propagation
  • Establish incident response playbooks with agricultural supply chain partners
  • Negotiate cyber liability insurance that covers business interruption, not just ransomware payment

    • ---


    ## HackWire Analysis


    The Mackay Sugar incident reveals a troubling reality: ransomware groups have discovered that attacking agriculture is exponentially more effective than attacking technology companies. When a tech company's systems go offline, the business loses revenue but survives. When a sugar mill's systems go offline, harvested cane rots, growers and processors lose money they cannot recover, and the attacker's pressure to pay becomes irresistible.


    The Gentlemen's targeting of Mackay Sugar—combined with a rising trend of agriculture-sector attacks—suggests a deliberate shift in ransomware group strategy. Rather than pursuing "easier" targets in technology or finance, sophisticated groups are recognizing that agriculture's compressed timelines and low tolerance for downtime make it the highest-leverage target available. Crop windows are measured in weeks. Milk spoils in days. Cane degrades in hours. There is no negotiating with physics, and ransomware groups are pricing their attacks accordingly.


    What makes this particularly concerning is that Mackay Sugar appears to have run a competent incident response: isolation, manual workarounds, deliberate system restoration. Yet even with a solid response, the company needed five days to resume any operations at all. In agriculture, five days is an eternity. That mathematics—attacker advantage built into the biology of crops—explains why The Gentlemen and competing ransomware groups are moving up the agricultural supply chain.


    The unknown that could reshape this incident: whether The Gentlemen obtained OT access. If industrial control systems were compromised, Mackay Sugar faced a decision matrix that technology companies never encounter. Restore encrypted IT systems? Possible with backups. Restore encrypted ICS systems? That means rewriting firmware, recalibrating sensors, and potentially replacing hardware. At that point, paying ransom can be faster than restoration—a calculus that ransomware groups are counting on.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)