Aus Mining And Manufacturing Breaches Going Undetected For Weeks – Secolve

Australian mines and factories are taking more than a month to detect data breaches, with some intrusions remaining hidden for more than a year, according to new research released by Secolve.

The vendor analysed data obtained through a Freedom of Information request lodged with the Office of the Australian Information Commissioner in August. The FOI covered all notifiable data breach reports submitted by mining and manufacturing operators between February 2018 and August 2025.

The company reviewed 187 incidents affecting between 800,000 and 3.6 million individuals across that period.

Long Delays In Detection And Reporting

The report found that the average breach in these sectors is detected after 40 days. A further 39 days pass, on average, before operators report the incident to the regulator.

One incident remained undetected for 520 days. It then took another 84 days before it was disclosed to authorities, placing the total breach-to-notification timeline at almost two years.

Malware-driven breaches were the hardest to identify, taking operators 146 days on average to detect. Incidents involving brute force attacks were uncovered far faster, usually within three days.

Ransomware topped the list of breach sources, followed by phishing. Financial data featured heavily, with more than half of reported breaches involving financial information.

Difficult Environments To Secure

Secolve works across mining sites, factories, hospitals and transport systems. The provider has repeatedly raised concerns about the difficulty of securing ageing industrial systems and mixed-technology environments.

Chief Executive, Laith Shahin, said the FOI findings reflect how hard it is for operators to identify malicious activity in operational networks.

“The data shows that the mining and manufacturing sectors are slow to identify breaches, with many going undetected for several weeks, months, or in some cases, more than a year,” Shahin said. “They are also slow in their legal obligation to report them to the regulator. These sectors have plenty of room for improvement.”

Shahin said industrial operators must prioritise detection tools and processes that help staff spot threats long before they have time to spread.

Ransomware Pressure Mounts

The report identifies ransomware as the most common cause of notifiable data breaches in mines and factories.

Shahin said criminals continue to favour these industries because downtime can trigger significant operational losses.

“Ransomware continues to plague these sectors, because cybercriminals know that they are lucrative targets,” he said. “Downtime can cost mining and manufacturing operators millions, so they may be more inclined to pay up. We also see a surprising number of breaches involving financial records. It’s critical that operators focus their attention and security budgets on protecting these high value datasets.”

Secolve’s Recommendations

The vendor provides cyber advisory, offensive testing and specialised training for operational technology environments. It argues that many factory and mine operators still lack foundational practices, such as segmentation, visibility across legacy equipment, or routine threat hunting.

Secolve maintains that a risk-based approach remains the most effective strategy given the diversity of industrial systems and the financial impact of outages.

Last Updated on November 22, 2025 by Nick Ross