The situation
A Queensland sugar mill operator experienced a significant ransomware attack that compromised its operational technology environment across mill sites in the lead-up to crushing season. The business needed immediate specialist OT engineering support, not generic IT incident response. The challenge was compounded by a complex OT environment: multiple legacy Windows servers, an ageing Active Directory domain, Rockwell and SCADA control systems, and a site network that had evolved without a formal cybersecurity framework in place.
With production operations at risk and the full scope of the compromise still being determined, the priority was to follow structured OT incident response procedures: containing the affected systems, preserving evidence for forensic review, and recovering control capability as quickly as possible from verified sources.
Our approach
- Deployed on-site as OT cybersecurity lead, providing OT-specific advisory and coordinating between the forensic IT team and the operator’s operational engineering staff.
- Conducted an asset documentation exercise across all affected machines, cataloguing PCs, servers, and OT assets within the incident scope.
- Supported deployment of forensic software across OT assets to enable evidence preservation and system analysis.
- Located, verified, and catalogued backups of PLC programs, SCADA configurations, historian data, and system software, establishing which backups were clean and could be used for recovery.
- Managed the systematic reinstallation of servers and client workstations from verified backup sources, following a controlled recovery sequence to avoid reintroducing compromised software.
- Coordinated the rebuild of NAS (Network Attached Storage) infrastructure to provide secure, verified backup repositories going forward.
- Maintained a licensing and asset register throughout recovery to track progress and verify system states.
- Documented findings and recommended immediate network hardening measures as part of the incident closeout.
Outcome
The operator’s OT environment was systematically contained and recovered. All critical PLC and SCADA systems were restored to operation from verified backups, following structured OT incident response procedures throughout.
The incident response also established a clear baseline for a broader OT Cybersecurity Improvement Roadmap, aligned to ISA/IEC 62443 and NIST CSF 2.0 standards, covering the operator’s mill sites. Beetle Engineering continues to provide ongoing OT cybersecurity advisory support as part of a sustained improvement programme that addresses the structural OT network and security posture issues the incident exposed.
The key lesson from this engagement: OT incident response requires engineers who understand both the cybersecurity response process and the control systems being recovered. Recovering a SCADA server is not the same as recovering a business file server. The sequence matters, the dependencies matter, and the verification process is different.