The mining industry’s increasing adoption of digital infrastructure and operational technology systems to support autonomous vehicles, drilling systems and remotely controlled equipment is giving rise to new cyberthreats, even as it improves safety, reduces operational costs and enables continuous operations.

Cyber incidents in the mining sector, particularly attacks on operational technology systems that involve cloud computing, Internet-of-Things sensors and automated machinery, have tripled in recent years.

Global law firm A&O Shearman says criminal gangs, State-sponsored hackers and individual threat actors have become a growing threat in the mining industry, where cyberattacks are increasingly launched to disrupt geopolitically important supply chains, extort companies or conduct espionage.

The risks are particularly prevalent for third-party service providers such as technology and software vendors, as well as original-equipment manufacturers, requiring mining companies to be diligent and to coordinate across their operations, IT and legal departments.

Research by technology company IBM found the global average direct immediate expense to address data breaches in 2024 was $4.88-million, 10% higher than in 2023. A&O Shearman says these costs relate to legal, technical and forensic expertise to manage the incident, as well as costs to rebuild IT and operational technology systems.

The World Economic Forum (WEF) states in its ‘Global Cybersecurity Outlook 2026’ that 78% of the CEOs surveyed consider third-party and supply chain vulnerabilities to be the greatest hurdle to becoming cyber resilient. Notably, the WEF’s outlook notes that only 30% of sub-Saharan African companies have the skills and capacity to achieve their current cybersecurity objectives.

The WEF also states in its outlook that IT and operational technology systems are increasingly converging, whereas strict segregation of IT and operational technology systems used to be the norm. The challenge, however, is that governance practices around operational technology remain inconsistent and often siloed within operational teams.

Expanding on this point, consultancy Accenture South Africa cybersecurity lead Boland Lithebe, who was part of a panel on mine technology hosted recently by Creamer Media, said that IT teams have traditionally had an understanding of risk. However, the increasing systems on the operational technology side to optimise operations is introducing new risk types that mining leaders need to be aware of and manage.

He said that at times pieces of third-party software are “poisoned” with vulnerabilities, requiring a holistic approach for mining companies to mitigate risk, including greater collaboration between internal IT personnel and operational technology operators.

“Cyberattacks will continue to grow. Mine leaders have to consider cyber resilience, including by having all employees understand the inherent cyber risks within their respective roles. This understanding should not be limited to executives and certain personnel, but permeate through the organisation.”

Another panel member, explosives manufacturer BME technology and marketing GM Nishen Haripersad, stated that mine challenges are no longer about collecting data but protecting it.

He said cybersecurity underpins confidence in the AI models that mines use. As the industry moves towards an autonomous mining future, he said, it will require trusted interoperability that can only be gained through secure data. Panel facilitator, public- private mining industry organisation Mandela Mining Precinct’s Julie Courtnage, agreed, explaining that the safe use of data and technology requires a “system of systems” and an integration mindset that places people at its centre.

Productivity and safety solutions company Probe IMT group chief technology officer Marko Kotzé echoed this view, explaining that technology and digitalisation are as much about people as they are about technology. “Technology is putting us at the forefront of being more proactive, but data is often fragmented or managed in silos.

“Technology can be held for ransom, which is detrimental to any mine. Cybersecurity and connecting systems with one another has to be embedded in the foundation of mining companies’ technology strategies.”

Tyre manufacturer Kal Tire Southern Africa VP John Martin mentioned that although the hacking of some autonomous inspection points poses very little risk, it is necessary to have cybersecurity essentials in place to ensure that all systems are as secure as possible and that data integrity is maintained across all service providers. “Everything that we do on the mine has to stand up to these protocols.”

Prime Driver

The WEF’s outlook identifies AI as the most significant driver of changes in cybersecurity, with growing recognition by companies globally that concrete actions are necessary to assess the security of AI tools.

Accenture South Africa country MD Kgomotso Lebele said AI is accelerating technological change across every sector of the economy, with tasks that once required significant time, specialised skills and large teams now increasingly performed faster and at greater scale. However, for organisations with existing security weaknesses, this creates additional pressure to strengthen cyber resilience.

He cites Anthropic’s latest AI model, Claude Mythos, which he said is able to identify hundreds of previously unknown software vulnerabilities across widely used operating systems and browsers, demonstrating the potential of AI as a defensive tool. However, this also highlights the broader reality that cyberthreats can now be executed far more quickly and at greater scales than ever before.

As AI capabilities mature, the potential impacts of cyber incidents also become more significant. “Automation is increasing the speed and scale at which these activities can occur,” Lebele stated, adding that AI can also be used for vulnerability discovery, reconnaissance and elements of attack planning.

With regard to data governance, AI systems depend on access to data, making it increasingly important for organisations to understand what information they hold, where it is stored and how it is protected. However, Lebele says only 18% of South African organisations have classified their data according to sensitivity, while just 24% have established clear policies governing AI use. Without these controls, managing risk and applying appropriate safeguards become more difficult.

Lebele noted that organisations with stronger security foundations and resilience built into their digital strategies will be better positioned to benefit from AI use and manage the risks associated with the technology.

Recommended Measures

The US National Institute of Standards and Technology recommends that an operational technology cybersecurity team should include IT personnel, control engineers, control system operators, security subject-matter experts and enterprise risk management teams.

The findings of the WEF’s cybersecurity survey point to organisations involving their security function in the procurement process to help mitigate cyber risk, assessing the security maturity of suppliers early on, aligning their cyber resilience strategies among ecosystem partners, mapping the ecosystem in detail to understand where partners are exposed to cyberthreats and simulating cyber incidents with ecosystem partners to devise recovery plans.

The WEF says cyber resilience underpins an organisation’s ability to minimise the impact of significant cyber incidents, including assessing rapidly evolving threat landscapes and emerging technologies, monitoring third-party and supply chain vulnerabilities, appointing skills and expertise specifically in cybersecurity and increasing the visibility of systems across an organisation’s departments.

In South Africa’s case, retrofitting legacy infrastructure requires careful consideration of the evolving technological landscape, as technological innovation can often outpace an organisation’s capacity to adopt and upgrade existing infrastructure.

When precious metals miner Sibanye-Stillwater experienced a cyberattack on its server and global IT system in July 2024, the company immediately executed its Incident Response Plan to safeguard its core operations.

The company managed to protect its data by isolating the affected networks and bringing in external expertise to investigate the hack. At the time, the company confirmed that only some smelting operations in the US and payroll systems were temporarily affected.

The WEF concludes that cyber risk is no longer only a technical issue but has also become a strategic, economic and societal concern that demands coordinated action across sectors and borders. The opportunity for mining leaders lies not only in technological innovation but also in strengthening governance, investing in skills and fostering a culture of trust and collaboration.

“The organisations that will thrive will be those that recognise cyber resilience as a shared, strategic responsibility.”