A wave of cyberattacks on European supermarkets last week exposed a vulnerability that extends well beyond refrigeration. For Australia, the national security challenge is protecting the interconnected critical infrastructure systems that sustain our economy, essential services and defence capability. As strategic competition intensifies, these systems are increasingly exposed to disruption by state-sponsored hacking groups that seek to exploit the connections between critical infrastructure sectors.
A supermarket refrigerator might seem an unlikely target, yet the attacks demonstrate how manipulating an ordinary piece of commercial equipment can disrupt food supplies, destroy stock and undermine public confidence. They also expose a broader vulnerability: an adversary does not need to destroy critical infrastructure to disrupt the systems on which a country depends.
In October, hackers reportedly compromised refrigeration controls at around 700 supermarkets across France, remotely raising temperatures to as high as 50 degrees C. Over the past week, similar incidents have affected supermarkets across Belgium, Luxembourg, Sweden, Finland, Ireland and Estonia. Refrigeration systems at three French blood-storage facilities were also targeted. The incidents aren’t confined to Europe, with the Pentagon investigating a suspected cyberattack following unexplained refrigeration failures at commissaries across at least six US military bases in early August.
Yesterday, French authorities attributed the October attacks to an Iranian Revolutionary Guard cyber unit, although responsibility for the subsequent incidents is less clear. The attacks exploited poorly secured, internet-connected operational technology. Without destroying infrastructure or deploying sophisticated weapons, hackers manipulated everyday systems to produce real-world disruption.
The attacks have not hit Australia, but the country is not immune. Critical infrastructure is an interconnected system of systems, where the operation of one sector increasingly depends on the availability and reliability of others. Physical infrastructure relies on digital networks, which in turn depend on power, telecommunications and physical assets. Both are underpinned by people, equipment, logistics and global supply chains.
Fragmented ownership and responsibility add to the complexity, with government agencies, private companies and international service providers operating to different security priorities, investment cycles and risk appetites. Yet the consequences of a cyberattack rarely remain within organisational boundaries, with disruption in one part of the system capable of cascading across sectors.
Australia’s food system illustrates these interdependencies. Agricultural production depends on reliable energy, water, fertiliser, fuel, machinery and communications. Once food leaves the farm, processing facilities, refrigeration, warehouses, transport networks, ports and distribution centres become equally important. Disrupting any one of these components can affect food availability, movement and affordability well beyond the immediate location of an incident. Similar dependencies extend across all other critical infrastructure sectors.
Technologies that can be managed remotely are increasingly embedded across facilities management, manufacturing, utilities and industrial operations. This creates potential access points into systems that were once largely isolated. A vulnerability in one part of this network can expose other organisations and sectors that depend on it.
The greater national security risk is that state-sponsored hacking groups can establish access to critical infrastructure networks ahead of a crisis, retaining the ability to disrupt them at a time of their choosing. Australia’s 2025–26 Annual Cyber Threat Report confirms that state-sponsored hacking groups target Australian critical infrastructure for espionage and potential pre-positioning for disruptive or destructive attacks.
Following the European attacks, the Australian Signals Directorate issued an advisory urging businesses to assess vulnerabilities in internet-connected operational technology and to secure remote access. Its Critical Infrastructure Fortify guidance encourages operators to develop the capacity to isolate critical systems from other networks for up to three months while maintaining essential services. While these measures strengthen individual operators’ resilience, a broader understanding of cross-sector dependencies is needed to anticipate and manage cascading disruption.
Last year, the Australian Security Intelligence Organisation (ASIO) assessed that espionage and foreign interference were at extreme levels and warned that authoritarian regimes are increasingly willing to disrupt or destroy critical infrastructure to impede decision-making, degrade warfighting capabilities and sow social discord. ASIO confirmed that cyber units from at least one nation state routinely seek to explore and exploit Australia’s critical infrastructure networks and are almost certainly mapping computer systems to enable the deployment of malware or maintain access for future use. In its 2026 threat assessment, ASIO identified energy and communications infrastructure, plus any infrastructure that supported the military, as priority targets.
For Australia, the consequences could extend well beyond the immediate disruption of essential services. In a regional crisis or conflict, an adversary’s access to critical infrastructure networks could constrain Australia’s ability to mobilise and sustain military operations, disrupt logistics, interrupt essential services and weaken public confidence. Civilian infrastructure could become a means of undermining defence preparedness without directly targeting the Australian Defence Force.
The new cold war is not being fought exclusively through military deployments, weapons systems or territorial contests. Access to the critical infrastructure, technology and supply chains that sustain modern economies is becoming another dimension of strategic competition.
Protecting individual critical infrastructure assets is no longer sufficient. Australia needs a broader understanding of how these systems connect, where their dependencies lie and how disruption in one part of the network could affect the whole. The ability to maintain essential services, sustain economic activity and support military operations under pressure will be central to Australia’s national security and strategic resilience.