Reported cyber incidents in Mining tripled in 2024 — and that is only what is reported.
Named Australian cases include Rio Tinto (Cl0p via the GoAnywhere file-transfer platform, 2023) and Northern Minerals (BianLian, 2024).
Why Mining and Resources are in the crosshairs
Five shifts shaping the Australian mining threat environment — what attackers are doing, and what regulators now expect of operators and their suppliers.
Reported incidents tripled in 2024, and under-reporting hides the rest
MM-ISAC's 10-to-30 jump year-on-year is the cleanest sector-specific metric available, and Rob Labbé has been explicit that these are only the incidents MM-ISAC knows about. In Australia, mandatory 72-hour ransomware payment reporting from 30 May 2025 and the Cyber Incident Review Board will improve visibility.
Automation and IT/OT convergence keep expanding the attack surface
Rio Tinto's Gudai-Darri, which it opened in 2022 as its most technologically advanced mine, is emblematic of what is happening across the sector — autonomous haul trucks, remote operations centres, digital twins, predictive-maintenance sensors, and integrated ERP-to-pit systems. Each new connection blurs the IT/OT boundary and adds ground that a compromised corporate credential can now reach.
Contractors and suppliers widen the attack surface
In June 2025 DragonForce claimed Pressure Dynamics International, a WA hydraulics and integrity contractor to oil and gas and defence clients, and published historical site and customer reports. Verizon's 2026 DBIR found a third party involved in 48% of breaches, up 60% on the previous year.
Double-extortion exposes payroll, employee, and family data — not just IP
Rio Tinto's March 2023 Cl0p/GoAnywhere incident exposed payroll data, overpayment letters, and employee family information. Northern Minerals (BianLian, March 2024) lost corporate, operational, financial, employee, shareholder, and executive email data. This is the concrete PII exposure that triggers OAIC notification and class-action exposure, on top of any operational impact.
The regulatory floor keeps rising
SOCI obligations attach to specific assets, such as critical gas, liquid fuel and electricity assets, not to mining as a sector. The Cyber Security Legislative Package 2024 introduced mandatory ransomware payment reporting and a Cyber Incident Review Board. DISP members face Essential Eight ML2 from 15 November 2025.
What experts are saying
Those are just the ones we know about. There is a massive under-reporting in cyber incidents.
We face daily attempts, as all companies do. Common attacks range from password spraying and brute forcing to social engineering and phishing/vishing campaigns.
Businesses and organisations must operate with a mind-set of ‘assume compromise’ and consider which assets or ‘crown jewels’ need the most protection.
Mining is under escalating cyber pressure
MM-ISAC logged three times as many attacks on mining in 2024 as in 2023. Gas processing facilities, liquid fuel assets and power stations that resources companies own can be critical infrastructure assets under the SOCI Act.
Mining is not a SOCI Act sector in its own right. Obligations attach to specific assets an entity owns or operates, such as a critical gas asset (for example, a gas processing facility above the capacity threshold), a critical liquid fuel asset, a critical electricity asset, or an asset the Minister declares. For those assets the CIRMP must address four hazard vectors: cyber and information security, personnel, supply chain, and physical security and natural hazards. For the cyber vector, entities must comply with one of five listed frameworks or an equivalent. Energy entities may choose the AESCSF. Mining entities also have obligations under the Privacy Act 1988.
LegislationFederal legislation covering 11 critical infrastructure sectors, including energy. Resources entities holding critical gas, liquid fuel or electricity assets must maintain a CIRMP addressing four hazard vectors. NodeZero gives attack-based evidence for the cyber hazard vector, including the IT side of the s 6(c) risk of interference with operational technology or ICT, and the s 6(e) risk of remote access to operational control or monitoring systems, tested from the IT side of the boundary. For the cyber vector, entities must also comply with one of five listed frameworks, or an equivalent.
Prescriptive and technically focused. Eight specific mitigation strategies with clear pass/fail controls. Common for government-adjacent entities, defence industry, and smaller organisations adopting ASD guidance.
Where NodeZero appliesBroad lifecycle coverage from governance through recovery without mandating specific technologies. Suited to entities operating across jurisdictions or mapping existing controls into a flexible structure.
Where NodeZero appliesInternational management system standard with formal certification. Chosen by larger entities with mature security programs, international operations, or existing ISO certification investment.
Where NodeZero appliesMaturity model assessing organisational capability across 10 domains. Originally built for the US electricity sector. Process and governance oriented — less about specific controls, more about repeatable capability.
Where NodeZero appliesSector-specific to energy. Derived from C2M2 and NIST CSF with Australian privacy additions. Managed by AEMO. The default for electricity and gas market participants with OT/ICS environments.
Where NodeZero applies
One of the five cyber frameworks the CIRMP Rules recognise, and a common basis for an information security management system.
Where NodeZero applies
Mining operators hold employee, contractor, and community stakeholder personal information subject to the Australian Privacy Principles.
Where NodeZero applies
Mandatory 72-hour ransomware payment reporting for businesses with turnover above $3M and for SOCI responsible entities.
Where NodeZero appliesA cascade of new obligations
Multiple new regulatory requirements are hitting simultaneously — each increasing the compliance burden and the consequences of failure.
SOCI Act — responsible entities for critical energy assets
In effectResponsible entities for critical gas, liquid fuel and electricity assets must register them, maintain a CIRMP with a board-approved annual report, and notify cyber incidents within 12 or 72 hours.
Cyber Security Act 2024
30 May 2025Businesses with turnover above $3M, and SOCI responsible entities, must report ransomware payments within 72 hours.
Critical Minerals Strategy 2023-2030
In effectAustralia's Critical Minerals List identifies the minerals essential to defence and energy security — 31 resource commodities as at February 2024. A policy strategy rather than a regulatory instrument.
State mining regulations — Cyber/OT overlap
In effectState mine-safety guidance on autonomous mining plant, such as the NSW Resources Regulator's guideline, asks operators to consider cyber security as part of managing work health and safety risk.
Find your organisation
See how the changes affect you specifically
Tier-1 miners & oil and gas
Global-scale mining and energy operators with complex IT/OT networks, Remote Operations Centres and, where they hold critical energy or fuel assets, SOCI Act obligations.
View details →Mid-tier miners & explorers
Mid-tier operators and explorers in gold, copper, lithium, and rare earths. Fewer dedicated cybersecurity staff, the same attackers.
View details →Mining services companies
Contract mining, drilling, maintenance and engineering providers whose people and systems connect into client operations.
View details →Why security teams trust NodeZero
Validate your IT/OT boundary before the next incident
See how NodeZero tests IT network resilience and segmentation in your mining environment