A cyberattack delayed smelting and recycling at Sibanye-Stillwater’s Columbus complex in Montana in July 2024. The company later confirmed unauthorized access to business and employee information and system recovery. The exact restoration date and the conflicting operator claims remain unresolved.
Threats to publish or sell stolen data without evidence of encryption.
Unauthorized access to systems, accounts, networks, or data.
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Manufacturing, production, assembly, processing, or industrial operations were reduced, stopped, or impaired.
Services continued but with longer processing, response, delivery, or completion times.
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.
The actor explicitly threatened to publish or publicly release victim data or incident details.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
A cyberattack disrupted Sibanye-Stillwater’s information systems and delayed smelting and recycling at its Columbus metallurgical complex in Montana in July 2024. The company confirmed the processing delays and use of manual workarounds. Later notices warned of possible U.S. employee-data exposure, and the company’s annual filing subsequently confirmed unauthorized access to business and employee information. The incident is presumed resolved, with the exact end of disruption unverified.
MTN News reported computer outages on July 10. The report described the company’s subsequent statement that only payroll was affected, alongside a United Steelworkers official’s account that disabled automated systems had affected the Columbus smelter. Employees remained on the job.
The company’s July 11 announcement confirmed a global cyberattack and containment measures. Its July 25 update then acknowledged that IT outages delayed both smelting of underground concentrate and recycling of spent automotive catalysts at Columbus. It said mining and extraction continued globally with limited disruption. These findings establish a processing interruption without showing that every mine or the entire complex stopped operating.
The company said most systems were back by July 25, but anticipated a return to full Columbus operations and later processing of accumulated material. It also moved its half-year results announcement from Aug. 29 to Sept. 12.
In its Sept. 12 presentation, the company said the majority of its technology environment had been restored within three weeks. It described Montana stockpiles accumulated during July and August that would be processed later. Its third-quarter update subsequently linked the processing downtime to approximately 20,000 ounces of above-normal mine-concentrate inventory during that quarter. Planned year-end processing is not evidence of a completed backlog clearance, and the reviewed sources do not supply an exact restoration date.
A Sept. 7 employee notice said the attack was discovered around July 8. Investigators identified indications of unauthorized activity on U.S. systems dating to mid-June; the notice did not give an exact initial-access date. Potentially affected employee files included contact and identity details, Social Security and tax identifiers, financial information and health-plan information. The company offered identity and credit monitoring.
In its 2024 annual filing, filed April 25, 2025, the company said an unauthorized party accessed business and personal information, mainly concerning current and former employees. It also reported restoring affected systems from available restore points and preserving critical enterprise-system data integrity. That recovery finding does not negate the separately disclosed access to personal information.
A July 22 Hackmanac post documented a RansomHouse listing alleging 1.2 terabytes of stolen data. Its attached claim image also alleged encryption and pressured management over threatened disclosure. These are claims, not independent findings about the attack’s method or data volume.
The company’s spokesperson had told Miningmx that no ransomware had been found at that early stage and the operator was unknown. Later reporting by The Record instead named RansomHub, conflicting with the contemporaneous RansomHouse observation. The reviewed company notices do not identify the operator. Responsibility, encryption and the claimed theft volume remain unverified.
A local MTN News report described a complaint filed Sept. 20, 2024, in Yellowstone County District Court by current and former employees alleging that the company failed to protect personal information. The report does not establish liability, class certification or a final outcome.
The exact restoration date, completion of the processing backlog and any ransom payment remain unverified. The annual filing’s discussion of recovered systems does not establish when every service returned or resolve the conflicting operator reports.
A July22,2024 Hackmanac post documented a RansomHouse listing alleging1.2terabytes and encryption, with a management-contact pressure message over threatened data disclosure. Original observer post and image verified; underlying listing’s first publication date unknown. Company did not confirm the operator, encryption or volume. A later report instead named RansomHub; preserve the contradiction.
The metallurgical complex at 1600 E. First Ave. S. in Columbus experienced smelting and recycling delays and used manual workarounds. The incident does not establish a citywide outage or an attack on municipal government.
Stillwater County contains the Columbus metallurgical complex where cyber-related smelting and recycling delays occurred. These effects do not establish countywide disruption or an attack on county government.
We reported cyber-related delays at the Montana metallurgical complex, payroll disruption and a RansomHouse allegation.
MTN reported computer outages, the company’s payroll-only account and a union official’s account of disabled smelter automation; employees remained at work.
The company confirmed a global cyberattack, isolated systems and said remediation was ongoing with limited operational disruption.
Spokesperson James Wellsted said systems were being restored gradually, the operator was unknown and no ransomware had been found at that stage.
Hackmanac documented a RansomHouse listing alleging 1.2 terabytes of stolen data. The attached image also claimed encryption and threatened disclosure.
The company confirmed Columbus smelting and recycling delays, manual workarounds, largely restored systems and a two-week delay in its results announcement.
The mining-sector ISAC reported a RansomHouse allegation of 1.2 terabytes as of July 22.
The company said it discovered the incident around July 8. An Aug. 19 finding identified unauthorized U.S. systems activity dating to mid-June, with employee information potentially affected.
The company reported restoration of most technology systems within three weeks and Montana processing stockpiles still scheduled for processing during 2024.
The report describes an employee-data breach but names RansomHub, conflicting with the contemporaneous RansomHouse observer record.
The company linked Columbus processing downtime to about 20,000 ounces of above-normal mine-concentrate inventory during the third quarter.
The company confirmed unauthorized access to business and employee information, restoration of affected systems from available restore points and preservation of critical enterprise-system data integrity.
MTN News reported that current and former employees filed a complaint alleging failure to protect personal information after the 2024 cyberattack.
Signed-in members can report an error, update, or missing source.
