It’s 5.45am on changeover day at a gold operation in The Pilbara. The incoming swing is walking into pre-start, the mill is running and there’s a planned shutdown three weeks out but suddenly, the ERP won’t load.
Planning can’t release work orders for the shut. Purchasing can’t raise an order for a critical spare. By crunch time, purchase commitments are going out by email, production tonnes are on somebody’s spreadsheet and approvals are being given verbally.
For dozens of Australian miners in May 2026, that scenario was real.
What happened in the Scope Systems cyber attack?
A cyber attack on Scope Systems, the Perth-based Pronto Xi specialist, cut mining customers off from their hosted ERP. Dozens of mostly Australian miners were affected, including Northern Star Resources and Evolution Mining, two of the country’s largest gold producers. The Mining and Metals ISAC called it the broadest single third-party cyber event the sector has seen.
The attack wasn’t on the miners. It was on their supplier. We covered what the Scope incident means for the mining industry when it happened. Mid-tier producers, juniors and explorers carry the same dependencies as BHP and Rio Tinto, without the security team or the budget.
You might not be able to match their spend but their thinking is free & up for grabs.
What do BHP and Rio Tinto do differently on cyber security?
They treat cyber as an operational risk, managed like any other threat to production. Rio Tinto reports cyber security among its principal risks, covering prevention, detection, response, recovery and supplier resilience together. BHP treats technology failure as a cause of operational stoppage.
Which systems would stop your mine if they went offline?
Usually fewer than you’d expect. The ERP, whether that’s Pronto Xi, SAP or similar. The maintenance system behind shutdowns and fleet availability. The fleet management system running dispatch. Mine planning and grade control. SCADA on the fixed plant. And the link connecting site to head office.
The majors rank these by cost of downtime, not licence cost, and let the ranking set the budget. For a gold producer, a day without dispatch is ounces that don’t get poured. For an explorer mid-campaign, it’s drill rigs on standby rates while assay results and the geological database sit out of reach. Our virtual CIO team runs this ranking with mining leadership teams before anyone talks about products.
Is your supply chain part of your cyber risk?
Yes. Your ERP host, telco, OEMs with remote access to fixed plant and mobile fleet, assay labs, drill and blast contractors and logistics partners all hold access to your environment or run something you can’t operate without.
Rio Tinto expects suppliers of critical services to hold disaster recovery arrangements and restore within agreed timeframes. You can do the same. Take your ten most important vendors and ask four questions. What stops if they go dark? What recovery time have they committed to in writing? Can you get your own data out independently? Who reviews their standing access? A framework like SMB1001 gives you something concrete to ask a supplier to show you.
Supplier risk arrives by email too. A geologist at one of our mining clients received a phishing email from a compromised supplier’s genuine account. Our 24/7 Security Operations Centre had the attacker locked out in four minutes, before any company data was touched.
How do you stop an office breach reaching the plant?
With segmentation and access control. OT/IT convergence means OEMs support plant remotely, condition monitoring and dispatch data flow back to Perth, and autonomous haulage relies on links that used to be isolated. A compromised mailbox at head office now sits much closer to the systems that move ore.
Attackers now take 29 minutes on average to move from first access to other systems, according to CrowdStrike’s 2026 Global Threat Report. So the layers worth paying for slow them down and catch them: identity controls, network segmentation between corporate and operational networks, endpoint detection and response, email security and monitoring around the clock. Add cyber awareness training built for FIFO rosters. We audit what you already own before recommending anything new.
Can you actually recover, or do you just think you can?
Most operations have backups. Far fewer have watched a full recovery run. Perseus Mining found its legacy disaster recovery system was failing to replicate and its backup reporting couldn’t be trusted. We rolled out business continuity and disaster recovery across its offices and three operating mine sites in Côte d’Ivoire and Ghana, with automated recovery testing every day. As Group Technology Manager Stacey Squire put it: “Every recovery we’ve attempted has worked.”
Where the link to head office is the weak point, Starlink as a second path and Azure Local at site keep critical workloads running when the connection drops.
How can Ever Nimble help WA mining companies?
We look after mining and exploration operations across Western Australia, South America, Africa and China. We have ranked in the MSP 501 six years running. Mostly though, we speak plain English and we understand how a mine actually runs.
If you can’t say with confidence what happens when a critical system, supplier or site goes offline, that’s the first thing worth sorting out. Have a chat with Chris or Ellis, or book a review below.
Book a Continuity & Cyber Readiness Review >
FAQs
Do mid-tier and exploration mining companies need enterprise-level cyber security?
They need enterprise-level discipline, not enterprise-level spend. Work out which platforms the operation can’t run without, put layered controls around those first, manage supplier and OEM access properly and test your recovery. That protects production without a major’s budget or a dedicated security team.
Why is supply chain cyber risk a growing threat in mining?
Because mine sites depend on third parties that hold access or run essential services: ERP hosts, OEMs, contractors, assay labs, logistics partners and communications providers. If one is breached or goes offline, production, procurement and statutory reporting can all stall, even when your own cyber security is strong.
What is a layered cyber security approach?
Layered cyber security, also called defence in depth, means running several controls together so that no single product is relied on. Identity and access management, network segmentation, endpoint detection, email security, 24/7 monitoring, backups and incident response each cover different ground. When one layer fails, another catches the problem before it spreads from the office to the plant.
How can WA mining companies build cyber resilience without a major’s budget?
Start with the systems and suppliers that would cause the biggest operational and financial hit if they failed. Concentrate security, monitoring and recovery there, test the plan under realistic conditions, then build outwards. In WA’s remote operating environment, site connectivity and vendor dependencies usually deserve attention first.
What should a mining company ask its ERP or IT supplier about cyber security?
Ask what recovery time they’ve committed to in writing, how often they test their own restores, whether you can export your data independently, and who holds standing access to your environment. Then ask for evidence, such as a current certification against a framework like SMB1001 or ISO 27001. A supplier that can’t answer is a risk to production worth planning around.
How often should a mining company test its disaster recovery?
Often enough that nobody is guessing. Backups should be verified automatically every day, and a full recovery of critical systems such as the ERP and maintenance system should be rehearsed at least once a year, and again after any major change like a new site or acquisition. Include a scenario where the link to site is down. Our disaster recovery service runs automated recovery tests daily.