Cybersecurity for Mining: Threats, OT and Controls

Modern mines are remotely operated industrial systems spread across pits, plants, rail and ports, and a ransomware attack on the business network can stop shipments and engineering work even when no controller is touched. Mining combines heavy OT (processing plants, hoists, ventilation, autonomous haulage), remote sites connected by private wireless and satellite, a deep reliance on equipment makers and contractors, and commercially sensitive exploration and resource data that state actors want. Unlike energy or water, mining is rarely named in critical infrastructure cyber law, so most programmes are driven by safety duties, listed company disclosure and insurers. This guide covers the threat picture from government and company sources, the regulation that does and does not apply, and the controls that matter most. It is for security leads, OT engineers and operations managers at miners, mining contractors and equipment suppliers.

Key takeaways

IT incidents stop mining businesses. Weir isolated core ERP and engineering applications after an attempted ransomware attack in September 2021 and reported about GBP 50 million of revenue deferred in that month, with its Minerals division the most affected.
Exploration and resource data is a target. Canada's national threat assessment links PRC espionage interest to resource extraction, including critical minerals, and the 2024 Northern Minerals leak included project, research and shareholder data.
Cyber risk is a safety risk. Autonomous haulage, hoisting, ventilation and tailings monitoring connect cyber events to life safety, so OT security must sit inside the safety management system, not beside it.
Regulation rarely names mining. NIS2, Australia's SOCI Act and Chile's Framework Cybersecurity Law cover adjacent sectors (energy, ports, transport) far more than mines, so check each asset, especially owned power, rail and port facilities.
Remote access and OEMs are the front door. Remote operations centres, OEM support links and contractor laptops are the paths into site OT; every one needs an owner, MFA and a brokered, recorded session.

How mining OT differs from a typical plant

A mine is several industrial environments under one licence. The table shows where the differences come from. For the generic Purdue model and segmentation patterns, see the OT Security Guide; this guide focuses on what is specific to mining.

Domain	Typical systems	Characteristic exposure	Priority controls
Pit and fleet (open cut)	Autonomous haulage and drilling, fleet management, collision avoidance, high precision positioning, private LTE or Wi-Fi mesh	Wireless networks covering large areas, OEM controlled autonomy stacks, remote control from operations centres	Segmented fleet network, OEM access brokering, change control on autonomy software, safe state on loss of communications
Underground	Ventilation on demand, hoist control, refuge chamber monitoring, leaky feeder and wireless, personnel tracking	Life safety systems, harsh environment devices that are rarely patched	Safety zone for hoist and ventilation, read only monitoring flows, tested manual operation
Processing plant	DCS, PLCs, crushing, grinding and flotation control, historians, laboratory systems	Historian and production reporting links to IT, many integrators	Zones and conduits, Level 3.5 DMZ, passive OT monitoring
Tailings and water	Piezometers, dam monitoring, pumps, water treatment	Remote sensors on cellular or radio, monitoring that regulators and communities rely on	Integrity checks on monitoring data, alarms on data loss, independent manual readings
Rail, port and power	Rail control, ship loaders, stockyard automation, owned generation and substations	Often regulated as transport, port or energy assets	Map to the relevant regime; see the Ports and Logistics Cybersecurity Guide and the Energy Sector Identity and OT Access Guide
Remote operations centres	Control rooms hundreds of kilometres from site, video, fleet and plant HMIs	Concentrates access to many sites in one network and one set of accounts	Dedicated OT network, strong authentication, session recording, resilience if the WAN fails

Threat picture

Public reporting on mining is thinner than for energy, but company disclosures and government assessments show three recurring threats.

Ransomware against IT that stops the business: Weir, a major supplier of mining equipment, said an attempted ransomware attack in the second half of September 2021 forced it to isolate and shut down IT systems including core ERP and engineering applications, disrupting engineering, manufacturing and shipments. It estimated a full year operating profit impact of GBP 10 to 20 million from revenue slippage plus GBP 10 to 15 million from overhead under-recovery, and direct costs of up to GBP 5 million, with no evidence of data exfiltration at the time. Evolution Mining reported a ransomware attack on its IT systems on 8 August 2024, said it did not expect a material impact on operations and informed the Australian Cyber Security Centre.
Data theft and extortion: Northern Minerals, a rare earths company, discovered a breach in March 2024; the BianLian group later published corporate, operational, financial, personnel and shareholder data. The company said the breach had no material impact on operations. Exploration results, resource models and offtake terms are price sensitive, so a leak can be a market disclosure problem as well as a privacy one.
State espionage on resources: the Canadian Centre for Cyber Security's National Cyber Threat Assessment 2025-2026 says provincial and territorial governments are likely valuable targets because they make decisions on resource extraction, including energy and critical minerals, and lists deep resource exploitation equipment among PRC industrial policy priorities. Miners, their joint venture partners and their advisers hold the same information.

The table maps entry and impact paths to MITRE ATT&CK (verified against v20) and to the control that breaks the chain.

Scenario	ATT&CK	Where it shows up	Control that breaks it
Stolen or dormant VPN credentials	T1133 External Remote Services, T1078 Valid Accounts, T0822 External Remote Services (ICS)	Corporate VPN, OEM support portals, remote operations access	MFA on every remote path, dormant account removal, brokered OT sessions
Ransomware on ERP, maintenance and engineering systems	T1486 Data Encrypted for Impact, T0828 Loss of Productivity and Revenue (ICS)	Maintenance planning, shipping and sales, engineering document stores	Dependency mapping, offline backups, manual dispatch and maintenance procedures
OEM or contractor access abused	T1199 Trusted Relationship, T0886 Remote Services (ICS)	Autonomy and fleet systems, plant integrators	Contractual controls, named accounts, approval per session, recording
Lateral movement from IT into plant control	T0866 Exploitation of Remote Services (ICS), T0859 Valid Accounts (ICS)	Historians, shared Active Directory, jump hosts	Separate OT identity domain, Level 3.5 DMZ, no direct IT to Level 2 flows
Laptop or USB brought to site	T0864 Transient Cyber Asset, T0847 Replication Through Removable Media (ICS)	Shutdowns, commissioning, remote sites with poor connectivity	Scanning kiosks, approved media, contractor device rules
Manipulation of fleet, hoist or ventilation control	T0832 Manipulation of View, T0827 Loss of Control, T0880 Loss of Safety (ICS)	Remote operations centres, underground control	Safety zone separation, independent safety functions, engineering workstation control

See the Top 10 OT Security Risks for the broader pattern.

Regulation and frameworks (status checked October 2026)

Few jurisdictions regulate mine cyber security directly. Obligations usually arrive through adjacent assets, company law and safety law.

Regime	How it reaches mining	What it asks for	Status and notes
Chile, Ley 21.663 Marco de Ciberseguridad	Essential service providers and operators of vital importance designated by the National Cybersecurity Agency (ANCI); mining is not named among the essential service sectors in the text we reviewed, but energy, water and transport assets owned by miners may be	Early alert within 3 hours of becoming aware of a significant incident, an update within 72 hours (24 hours for vital importance operators whose essential service is disrupted) and a final report within 15 calendar days	In force; confirm any designation with ANCI
Australia, Security of Critical Infrastructure Act 2018	Mines are not a SOCI sector, but owned energy, port, freight and water assets may be	Register reporting, incident notification and a risk management programme where rules apply	A July 2026 reform consultation proposed new asset classes, including critical freight and distributed energy, but not mining; it also proposed supplier cyber assurance requirements
EU NIS2 Directive (Directive (EU) 2022/2555)	Mining is not listed as a sector; energy, transport and some manufacturing activities of a mining group may be in scope	Article 21 risk management, Article 23 reporting	Applies through national transposition; see the NIS2 Directive Guide
Securities disclosure (US SEC Form 8-K Item 1.05; ASX continuous disclosure)	Listed miners and suppliers	Timely disclosure of material cyber incidents; annual cyber risk management disclosure for SEC registrants	Weir, Evolution and Northern Minerals all disclosed through market announcements
Mine safety law	Work health and safety and mine safety regulators in each jurisdiction	Hazard identification and control for plant and systems, including autonomous equipment	Rarely mentions cyber explicitly; treat cyber as a hazard in the principal hazard and autonomy safety cases

Industry guidance fills part of the gap. The Global Mining Guidelines Group guideline on autonomous systems (2019) lists cyber security among the safety requirement categories for autonomous mobile equipment and notes that it needs further attention. IEC 62443 provides the engineering language for zones, conduits and supplier requirements; see the IEC 62443 Guide and the NIST SP 800-82 OT Security Guide. For an adjacent regulated sector, see the Oil and Gas Cybersecurity Guide.

Safety, autonomy and the remote operations centre

Safe state on loss of communications: autonomous trucks and drills must stop safely when the network drops or is jammed. Test this as part of change control after every network or software update.
Change control on autonomy software: OEM updates to fleet and autonomy software change safety behaviour. Require release notes, a test window on a limited area and a rollback plan before site wide deployment.
Independent safety functions: hoist overspeed protection, ventilation alarms and gas detection should not depend on the same network or HMI that an attacker could reach. See the Safety Instrumented Systems Security Guide.
Remote operations centres: they concentrate control of many sites. Give them a dedicated OT network, separate accounts from corporate IT, recorded privileged sessions and a fallback to local control if the WAN or the centre fails.
Private wireless: private LTE and 5G networks carry fleet and safety traffic. Manage SIM and device credentials as an inventory and keep the core network on its own segment. See the 5G Security Guide.
Satellite links at remote sites: treat satellite terminals as internet facing devices with change controlled configuration. See the Satellite IoT and Satellite Communications Security Guide.

Priority controls

Inventory and dependency map: list every OT asset per site (controller, firmware, network, owner, OEM contract) and map which IT systems must work for ore to be mined, processed and shipped. Weir's case shows that ERP and engineering applications can be the dependency. See the OT Asset Visibility Guide.
MFA and brokered remote access: one broker in the DMZ for OEMs, integrators and the operations centre, with MFA, approval per session, time limits and recording; no standing third party VPN profiles. See the OT Remote Access Guide.
Segment IT from OT and sites from each other: a Level 3.5 DMZ for historians and patch servers, deny by default rules, and no flat WAN between sites. See the Network Segmentation Guide.
Offline backups of IT and OT: include controller logic, autonomy configuration and engineering files, stored offline and tested. See the Backup Security Guide.
Protect sensitive geological and commercial data: restrict and monitor access to resource models, drill results and deal rooms, including advisers and joint venture partners, and treat bulk downloads as a detection use case.
Supplier requirements in contracts: require OEMs and integrators to meet IEC 62443-4-1/4-2 style expectations, disclose vulnerabilities, support named accounts and notify you of compromises. See the Third-Party Risk Management Guide.
Passive OT monitoring: protocol aware monitoring at the DMZ, plant and fleet networks, feeding a SOC with OT playbooks. See the OT Incident Response Guide.

Choosing where to start

Junior explorer or single site developer: mostly IT and data risk. Focus on MFA, email security, protection of drill data and investor information, and a disclosure plan for a breach.
Single operating mine: the seven priority controls, an OEM access register and a site specific manual operation plan.
Multi-site miner with autonomy and a remote operations centre: a full IEC 62443 programme, a dedicated OT SOC capability, safety case integration and regular OT penetration tests in planned windows. See the OT Penetration Testing Guide.

Where identity fits

Mining OT is full of shared and non-human identities: shared operator accounts on plant HMIs, OEM support accounts with standing access to fleets, service accounts linking historians to the business, SIM and device certificates on private wireless, and default credentials on field sensors. Give each an owner and an expiry, replace shared logins with named accounts where the platform supports them, vault OEM and service credentials with checkout, and keep the OT directory separate from corporate Active Directory. See the Identity for OT Environments Guide and the Device and IoT Identity Guide.

Implementation: a phased programme

Phase 0, scope (weeks 0 to 4): list sites, OT domains, remote access paths and OEM contracts; identify adjacent regulated assets (power, rail, port, water) and disclosure obligations.
Phase 1, quick wins (months 1 to 3): MFA on all remote access, removal of dormant and standing third party accounts, closure of internet exposed OT, offline backups of controller logic. Validate each change on one site or one plant area first and keep a documented rollback.
Phase 2, architecture (months 3 to 12): DMZ and segmentation, a remote access broker, separation of the operations centre network, passive monitoring. Schedule cut overs in planned shutdowns.
Phase 3, safety integration (months 6 to 18): add cyber scenarios to principal hazard management and autonomy safety cases, test safe states on communication loss, and exercise a ransomware scenario with operations, safety and investor relations.
Phase 4, sustain: quarterly OEM access reviews, annual restore tests, supplier assessments at contract renewal and OT penetration tests on a rolling site schedule.

Detection and measurement

Log: remote access broker sessions, VPN and identity provider sign-ins, OT DMZ firewall traffic, engineering workstation activity, autonomy software changes and access to resource data stores.
Alert on: OEM sessions outside approved windows, new devices on fleet or plant networks, IT hosts talking to controllers, mass access to geological data, and backup deletion.

Metric	Target	Why it matters
Remote access paths into OT that pass through the broker with MFA	100 percent	Remote services and valid accounts are the main entry path
OEM and contractor accounts with a named owner and expiry	100 percent	Standing third party access is the hardest to see
Sites with a current OT asset inventory and dependency map	100 percent, reviewed yearly	Needed for segmentation, response and recovery
Restore tests of controller logic and ERP completed in the last 12 months	All critical sites	Recovery time decides financial impact, as Weir's figures show
Autonomy and fleet software changes made under change control with a tested safe state	100 percent	Links cyber change to safety assurance

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev. 5	CIS Controls v8.1	ISO/IEC 27001:2022 Annex A
OT asset and dependency inventory	ID.AM-01, ID.AM-08, GV.OC-04	CM-8	Control 1	A.5.9
Remote access and authentication	PR.AA-01, PR.AA-05	AC-17, IA-2	Control 6	A.5.15, A.8.5
Segmentation and wireless	PR.IR-01	SC-7, SC-8	Control 12	A.8.20, A.8.22
Backups and recovery	PR.DS-11, RC.RP-01	CP-9, CP-10	Control 11	A.8.13
OEM and supplier risk	GV.SC-07	SR-3, SR-6	Control 15	A.5.19, A.5.21
Monitoring	DE.CM-01	SI-4	Control 13	A.8.16
Risk assessment and incident response	RS.MA-01	RA-3, IR-4, CP-2	Control 17	A.5.24, A.5.29

Common failure patterns

Forgotten remote access accounts: an old VPN or OEM account without MFA stays enabled after a contract ends. The Colonial Pipeline ransomware attack began with exactly that, an unused VPN account with a leaked password and no MFA, and led to a precautionary shutdown of operations.
The operations centre as a flat network: remote control rooms join corporate and site networks for convenience, so one compromised workstation can see every site.
OEM owns the security of the autonomy stack: the miner has no visibility of OEM accounts, update timing or logs, and finds out about changes after the event.
Backups that miss OT: ERP is backed up but controller logic, autonomy maps and engineering files are not, so recovery depends on the integrator's laptop.
Treating data theft as an IT matter: leaked drill results or deal terms trigger disclosure duties, and the incident plan does not include investor relations and the company secretary.
Cyber outside the safety case: principal hazard plans assume control systems behave as designed, with no scenario for manipulated views or loss of control.

Practitioner checklist

Build an OT asset inventory and IT dependency map for every site, including owned power, rail, port and water assets.
Route all OEM, integrator and operations centre access through a broker with MFA, approval and recording.
Separate IT and OT with a Level 3.5 DMZ and keep the operations centre on its own network.
Keep offline backups of controller logic, autonomy configuration and engineering files, and test restores yearly.
Give every shared, OEM, service and device identity an owner and expiry, and keep OT identity separate from corporate AD.
Add cyber scenarios to principal hazard and autonomy safety cases and test safe states on communication loss.
Protect and monitor access to resource models, drill results and deal rooms, including partners and advisers.
Write supplier security requirements, vulnerability disclosure and breach notification into OEM contracts.
Include investor relations and legal in incident exercises so market disclosure decisions are ready.

Cybersecurity for Mining Guide: Threats, Regulation and Priority Controls