Mackay Sugar Hit by The Gentlemen Ransomware, Mills Shut

Australia’s second-largest sugar producer, Mackay Sugar, had its operations disrupted after a ransomware attack by the group known as The Gentlemen shut down several mills in Queensland. The incident, first reported around 10 June 2026, forced the company to halt harvesting and processing activities, with only partial manual operations restored in the days that followed. Although the attackers publicly claimed the victim on 15 June, available reporting indicates they have not yet leaked any stolen data.

Attack on industrial systems

Public reporting from SecurityWeek and The Record describes the attack as the work of The Gentlemen, also tracked as Storm-2697. The ransomware operators targeted Mackay Sugar’s industrial control systems and business networks, leading to the physical shutdown of mills. By mid-June the company had resumed limited operations, but the full scope of any data accessed by the attackers remains unclear. No confirmed list of exposed customer, supplier or employee records has surfaced on leak sites, and the precise number of people whose information may have been accessed is unknown.

Risks to personal data

This matters for you and your family because even when a company says “no customer data was taken,” ransomware groups frequently access email addresses, phone numbers, employee details, supplier contracts and internal spreadsheets. If your name, address or contact information appears in any of those files, it can surface later in smaller breaches or be sold quietly on underground forums. For households in regional Queensland or anyone who does business with the sugar industry, the risk is concrete: one exposed record can lead to phishing texts, fake invoices or identity theft that affects your bank accounts, tax filings or children’s school records.

Identity-chain dangers

The doxxing and identity-chain implications are particularly concerning. Ransomware operators rarely stop at one dataset. They map relationships between work emails, personal phones, family addresses and even children’s online gaming accounts that reuse the same passwords or recovery details. A single leaked supplier contact record can link your professional identity to your home address, your children’s usernames and other services where credentials have been reused. Once those connections are made, opportunistic attackers can escalate from simple credential theft to full doxxing, account takeovers and harassment.