Loading story…
A cyberattack forced Mackay Sugar, Australia’s second-largest sugar producer, to shut down sugar milling and cane haulage at its Farleigh and Racecourse mills in Queensland’s Mackay region, disrupting harvesting operations across the area. Growers were told to cease harvesting immediately, and the company said it was using fallback measures to return cane trains already on the tracks to factories while prioritizing staff safety, business continuity, and the safe restoration of affected systems.
Mackay Sugar said it had engaged cybersecurity specialists and local authorities to investigate the incident and support recovery, but it did not disclose the attack type, whether data was compromised, or when the two mills would restart. Industry representatives said the outage was damaging for growers, though less severe than a disruption later in the crushing season, and the company’s third mill at Marian remained unaffected because it had not yet begun crushing operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Mackay Sugar said it found evidence that an external party accessed parts of its IT environment following the cyberattack. The company said it was working to verify whether any data was accessed while restoration efforts continued.
As of 2026-06-15, Mackay Sugar said it was making progress restoring systems that support cane supply, harvesting, and mill operations. The company reported steam trials were underway and a staged restart was expected later in the week, while growers and harvesters were told not to resume harvesting until further notice.
On 2026-06-15, the ransomware group The Gentlemen claimed responsibility for the Mackay Sugar incident by listing the company on its Tor-based leak site. SecurityWeek reported that no data had been leaked at the time of reporting.
By 2026-06-12, Mackay Sugar had resumed limited manual operations at one of its mills while restoration work continued with assistance from cybersecurity experts. The broader disruption still left two of the company's three mills offline during the peak crushing season.
Mackay Sugar said it was responding to the incident by engaging cybersecurity experts and local authorities to investigate and restore systems safely. The company also implemented temporary or fallback measures to maintain essential operations, including returning cane trains already on the tracks to factories.
A cybersecurity incident disrupted Mackay Sugar's operations, forcing the shutdown of the Farleigh and Racecourse mills in Queensland's Mackay region and suspending sugar milling and cane haulage. Growers were told to cease harvesting early Wednesday as the outage affected harvest operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcemkysugar.com.au
Open sourcetheregister.com
Open sourcescworld.com
Open sourcecysecurity.news
Open sourcemkysugar.com.au
Open sourceabc.net.au
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hackers have remotely tampered with operational settings in multiple Canadian critical infrastructure organizations, including a provincial water utility, an oil and gas company, and a grain drying silo. The Canadian Centre for Cyber Security issued an alert warning that attackers manipulated pressure valves at a water utility, degrading services, and triggered false alerts at an oil and gas company by altering automated tank gauges. In another incident, temperature and humidity controls were changed at a grain silo, creating potential safety risks. These attacks highlight the vulnerability of small, budget-constrained utilities to cyber threats targeting industrial control systems. The incidents underscore a growing trend of cyberattacks against critical infrastructure, with attackers exploiting remote access to manipulate physical processes and disrupt essential services. The advisory emphasizes the need for improved cybersecurity measures in the sector, as many organizations lack the resources and preparedness to defend against sophisticated threats. No specific attribution has been made public, but the attacks have raised concerns about the safety and reliability of essential services in Canada.
Jun 29, 2026
A cyberattack disrupted operations at **Vladimir Bread Factory**, a major bakery producer in Russia’s Vladimir region, after attackers hit the company’s internal digital environment overnight on Sunday. The incident knocked out office IT, including computers, servers, electronic document management tools, and the widely used **1C** enterprise accounting system, forcing the company to revert to **manual order and shipment processing** and move office staff to a round-the-clock schedule. While production lines and bakeries reportedly continued operating at full capacity, the outage significantly complicated order processing and deliveries, contributing to localized delivery failures and temporary shortages of the company’s bakery products. The attacker identity and incident type (e.g., ransomware vs. other intrusion) were not confirmed, and the company did not provide a timeline for full restoration of affected systems. Reporting also noted this incident in the context of broader cyber-related disruptions in Russia’s food sector, including a prior attack that disabled the country’s animal-based product certification platform (triggering paper-based workarounds and logistics delays) and a separate ransomware incident affecting a large dairy processing plant in southern Siberia in early 2025, which local media speculated may have been linked to the plant’s reported support for Russian troops in Ukraine (without official attribution).
Jun 29, 2026
Qantas disclosed that a cyberattack exposed personal data belonging to about **5.7 million to 6 million customers**, making it one of the most significant airline-sector breaches reported in Australia. Early reporting said the incident affected customer records rather than flight operations, with exposed information understood to include personal and contact details held in airline systems. Coverage also linked the intrusion to the broader wave of attacks against airlines and travel firms attributed to **Scattered Spider**, a financially motivated threat group known for social-engineering tactics and extortion. Subsequent reporting said Qantas was among nearly **40 companies** facing ransom demands from the same hacker group, and that attackers later leaked data containing roughly **5 million customer records** after a ransom deadline passed. The leak escalated the incident from a large-scale breach to a public extortion event, increasing the risk of fraud, phishing, and identity abuse for affected customers while underscoring the aviation sector's exposure to coordinated intrusion-and-ransom campaigns.
Jul 3, 2026