The ransomware attack against Mackay Sugar was carried out by The Gentlemen (also tracked as Storm-2697), a cybercriminal group active since mid-2025. The attack encrypted files and exfiltrated data to coerce payment. The incident disrupted operations at two of Mackay Sugar's three mills, forcing shutdowns and halting cane processing and logistics systems. Restoration efforts are ongoing, with partial manual operations resumed. No data leaks have been confirmed, and it remains unclear whether operational technology or industrial control systems were compromised. The Gentlemen group is known for malware with worm-like lateral movement capabilities and maintains a victim list exceeding 500 entities.

The ransomware attack caused operational disruption by shutting down two of Mackay Sugar's mills, affecting cane supply, harvesting, and processing. This led to halted acceptance of new cane and reliance on interim manual processes. No confirmed data leaks or compromises of industrial control systems have been reported. The incident impacted a critical agricultural production facility in Australia, potentially affecting supply chains and business continuity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mackay Sugar is actively restoring affected systems and has implemented interim manual processes to minimize disruption. There is no public information on patches or fixes related to this ransomware attack. Organizations should monitor official communications from Mackay Sugar and cybersecurity authorities for updates and recommended actions.