Mackay Sugar Cyber Security Incident Case Study

Incident sequence

1. 01

   A cyber incident stopped normal milling and cane logistics

   On 10 June 2026, Mackay Sugar disclosed a cyber security incident affecting some of its operations and activated specialist cyber security support, containment, and business-continuity processes. Farleigh and Racecourse mills stopped normal crushing, cane haulage was disrupted, and growers supplying the affected milling areas were instructed to cease harvesting while the company assessed and restored its systems.

2. 02

   Manual crushing preserved a narrow operational fallback

   By 12 June, Mackay Sugar had recommenced limited manual crushing at Farleigh Mill after operational and safety assessments. The fallback was used only to process cane that had already been harvested before the incident. Key cane-supply and logistics systems were still being restored and no additional cane was being accepted, demonstrating that manual production capability did not by itself restore the wider harvesting and logistics system.

3. 03

   Recovery depended on systems beyond the mill floor

   Mackay Sugar reported that restoration work covered systems supporting cane supply, harvesting, and mill operations. By 15 June the manual Farleigh crush had been completed and steam trials were underway, but growers and harvesters were still being told not to recommence harvesting until the company authorised it. The incident therefore affected an interconnected production system extending from farms and harvesters through cane transport to the mills.

4. 04

   Mackay Sugar confirmed unauthorised access to its IT environment

   On 17 June, Mackay Sugar said its investigation had identified evidence that an external party gained unauthorised access to parts of its IT environment. The company said it had implemented containment measures and was continuing to investigate the nature and extent of any information accessed. Public disclosures have not established the initial-access mechanism or confirmed direct compromise or manipulation of industrial controllers.