From fridges to nuclear power plants, hackers are gaining control

In the year 2000, on the sleepy banks of the Maroochy River on Queensland's Sunshine Coast, a new water treatment facility was experiencing technical difficulties.

Radio communications to wastewater pumps were not working, and the alarms designed to alert staff were not sounding.

Over a three-month period, more than 800,000 litres of untreated sewage was released into local waterways.

At first, council staff attributed the pump malfunctions to growing pains at the new plant.

But the real culprit? A hacker.

In the same year Australia cemented itself on the global stage hosting the first Olympics of the new millennia, it also secured its spot in the world of cybersecurity as the home of the first attributable case of operational technology hacking, becoming a case study used by engineers, academics and governments to this day.

Cyber-retribution a new war front

Operational technology (OT) is the hardware and software that monitors and controls physical machines.

OT is everywhere and is used to operate critical infrastructure such as power plants, conveyor belts, traffic lights, air traffic control systems and water treatment plants.

The Maroochy incident was 26 years ago, but OT hacking is now on the rise and will likely be supercharged by AI.

Earlier this month, hackers remotely raised fridge and freezer temperatures across hundreds of French supermarkets.

In July, 30 water systems across the United States were attacked, consistent with methods used by an Iranian-backed hacking group the CyberAv3ngers.

In June, a cyber security incident brought Australia's second-largest raw sugar producer to a halt, shutting down milling and cane haulage. A Russian-speaking group called The Gentleman claimed responsibility.

In March, the Handala Hack group, also said to be operating under the Iranian government, claimed responsibility for cyber attacks against medical equipment supplier Stryker. 

Since US President Donald Trump launched the war in Iran, the US Cybersecurity and Infrastructure Security Agency (CISA) has issued warnings regarding "ongoing Iranian-affiliated cyber targeting".

In other words: cyber-retribution.

Hacking has become targeted, a new war front for enemies across the globe to attack each other.

The Stryker hack was in retribution for the bombing of an elementary school in southern Iran.

Although the hackers targeted a US company, the attack put Australian hospitals on alert because it remotely wiped associated devices around the world.

Such attacks have obvious financial impacts, but as the technology powering them becomes more sophisticated, the scope and severity of the risks increase.

And as the world destabilises, incentives for hackers to cause harm, including the risk to human life, also increases.

Hacking goes nuclear

In 2025, hackers sponsored by China breached more than 400 agencies across the globe via Microsoft's SharePoint.

One of the agencies was the US National Nuclear Security Administration, the organisation responsible for managing the United States's nuclear stockpile, as well as the nuclear power plants on warships and submarines.

Although an IT hack, not an OT attack, Raji Rajagopalan, a senior fellow at the Australian Strategic Policy Institute, explained that such breaches could be used to conduct an OT hack later.

"They get into a system, lie dormant for a very long time and when there is an opportunity, get into sensitive areas," Dr Rajagopalan said.

"That could create lots of different nuclear incidents that could be really disastrous from a humanitarian perspective."

One protection that nuclear facilities use to prevent such a disaster is an air gap, meaning that administrative systems are largely disconnected from operating systems.

However, Dr Rajagopalan said the assumption that these separations were watertight was not entirely true.

"There are digital upgrades, remote monitoring. All of these always compromise that air gap," she said.

A hacker remotely triggering a nuclear meltdown may sound like the work of Hollywood, but one known incident proved it is closer to reality than fiction.

Stuxnet is a highly sophisticated computer worm.

It was designed as part of Operation Olympic Games, a secret US-Israeli joint cyber-sabotage campaign — although the US government has never publicly taken responsibility.

Stuxnet was unleashed on the Natanz Iranian nuclear facility, where it lay undetected between 2009-2010.

The worm targeted the centrifuges used to enrich uranium, causing them to spin out of control until they broke. It was also sophisticated enough to hide what it was doing.

Stuxnet destroyed at least 1,000 centrifuges at Natanz and set Iran's nuclear program back by about a year.

Such attacks make global headlines when they are discovered, causing policymakers to make sweeping statements at press conferences.

But, Dr Rajagopalan said, political momentum was often lost after the fact.

"Somehow it seems all very theoretical, sounds very futuristic,"

she said.

"You don't want to scare people away, but at the same time, people need to understand that there are consequences to these attacks, that these attacks are real."

Critical infrastructure a sitting duck

Why is OT so vulnerable? How is it that the most critical infrastructure in the world is so at risk of being hacked?

UQ cyber security expert Ryan Ko said the main issue with OT was that much of it had been installed 20 to 30 years ago before existing knowledge of the latest cyber threats.

The old legacy systems were increasingly connected to the internet, he said, and every piece of critical infrastructure connected with OT was at risk.

And with the rise of AI, the scope of cyber-attacks had "changed drastically".

"It is now easier for an adversary to automatically detect a previously unknown vulnerability," Professor Ko said.

OpenAI's rogue agent Medicare data portal hack raised significant alarms for the Australian government.

Although not an OT attack, the incident highlighted how AI can efficiently find weaknesses that in other circumstances could be leveraged by bad faith actors.

Domestically, the Australian Signals Directorate (ASD) provides frameworks for governments and businesses to boost their cyber-defences against what it has described as "increasingly complex and persistent threats".

"Critical infrastructure and operational technology are attractive targets for state-sponsored cyber actors, cyber criminals and hacktivists," an ASD spokesperson said.

Can we stop OT spiralling out of control?

Dr Rajagopalan said as OT hacking incidents increased, the possibility of inadvertent incidents spiralling out of control also increased.

It is a scenario where neither side may want to engage in "big open-ended conflict, but things going out of control".

In a fracturing world, not only does the current geopolitical climate increase the incentive for enemies to attack one other, but it also limits the ability for allies to work with each other.

"We don't see the major powers coming together, discussing and debating these issues in full earnest,"

she said.

One solution for Australia, Dr Rajagopalan said, could be partnering with multilateral organisations such as the Association of Southeast Asian Nations over major powers.

"Bring together smaller groupings of countries who have similar or like-minded interests and who have a certain amount of appeal to international law," she said.