In the year 2000, on the sleepy banks of the Maroochy River on Queensland's Sunshine Coast, a new water treatment facility was experiencing technical difficulties.
asserted
facility → experience → difficulties
Radio communications to wastewater pumps were not working, and the alarms designed to alert staff were not sounding.
asserted
alarms → work → staff
Over a three-month period, more than 800,000 litres of untreated sewage was released into local waterways.
asserted
litres → release → waterways
At first, council staff attributed the pump malfunctions to growing pains at the new plant.
asserted
staff → attribute → plant
In the same year Australia cemented itself on the global stage hosting the first Olympics of the new millennia, it also secured its spot in the world of cybersecurity as the home of the first attributable case of operational technology hacking, becoming a case study used by engineers, academics and governments to this day.
asserted
it → cement → day
Operational technology (OT) is the hardware and software that monitors and controls physical machines.
asserted
that → monitor → machines
OT is everywhere and is used to operate critical infrastructure such as power plants, conveyor belts, traffic lights, air traffic control systems and water treatment plants.
asserted
OT → use → plants
The Maroochy incident was 26 years ago, but OT hacking is now on the rise and will likely be supercharged by AI.
asserted
hacking → supercharge → AI
Earlier this month, hackers remotely raised fridge and freezer temperatures across hundreds of French supermarkets.
asserted
hackers → raise → supermarkets
In July, 30 water systems across the United States were attacked, consistent with methods used by an Iranian-backed hacking group the CyberAv3ngers.
asserted
systems → attack → group
In June, a cyber security incident brought Australia's second-largest raw sugar producer to a halt, shutting down milling and cane haulage.
asserted
incident → bring → milling
A Russian-speaking group called The Gentleman claimed responsibility.
asserted
group → speak → responsibility
In March, the Handala Hack group, also said to be operating under the Iranian government, claimed responsibility for cyber attacks against medical equipment supplier Stryker.
asserted
group → say → Stryker
Since US President Donald Trump launched the war in Iran, the US Cybersecurity and Infrastructure Security Agency (CISA) has issued warnings regarding "ongoing Iranian-affiliated cyber targeting".
asserted
Agency → launch → targeting
Hacking has become targeted, a new war front for enemies across the globe to attack each other.
asserted
enemies → become → other
Although the hackers targeted a US company, the attack put Australian hospitals on alert because it remotely wiped associated devices around the world.
asserted
it → target → world
Such attacks have obvious financial impacts, but as the technology powering them becomes more sophisticated, the scope and severity of the risks increase.
asserted
scope → have → risks
And as the world destabilises, incentives for hackers to cause harm, including the risk to human life, also increases.
asserted
hackers → destabilise → life
Hacking goes nuclear
In 2025, hackers sponsored by China breached more than 400 agencies across the globe via Microsoft's SharePoint.
asserted
hackers → go → SharePoint
One of the agencies was the US National Nuclear Security Administration, the organisation responsible for managing the United States's nuclear stockpile, as well as the nuclear power plants on warships and submarines.
asserted
One → manage → warships
Although an IT hack, not an OT attack, Raji Rajagopalan, a senior fellow at the Australian Strategic Policy Institute, explained that such breaches could be used to conduct an OT hack later.
uncertain
breaches → explain → hack
"They get into a system, lie dormant for a very long time and when there is an opportunity, get into sensitive areas," Dr Rajagopalan said.
"
asserted
Rajagopalan → get → areas
That could create lots of different nuclear incidents that could be really disastrous from a humanitarian perspective."
uncertain
that → create → perspective
One protection that nuclear facilities use to prevent such a disaster is an air gap, meaning that administrative systems are largely disconnected from operating systems.
asserted
systems → use → systems
However, Dr Rajagopalan said the assumption that these separations were watertight was not entirely true.
asserted
separations → say → ?
All of these always compromise that air gap," she said.
asserted
she → compromise → gap
A hacker remotely triggering a nuclear meltdown may sound like the work of Hollywood, but one known incident proved it is closer to reality than fiction.
uncertain
it → trigger → fiction
It was designed as part of Operation Olympic Games, a secret US-Israeli joint cyber-sabotage campaign — although the US government has never publicly taken responsibility.
asserted
government → design → responsibility
Stuxnet was unleashed on the Natanz Iranian nuclear facility, where it lay undetected between 2009-2010.
asserted
it → unleash → 2009
The worm targeted the centrifuges used to enrich uranium, causing them to spin out of control until they broke.
asserted
they → target → control
It was also sophisticated enough to hide what it was doing.
asserted
it → hide → what
Stuxnet destroyed at least 1,000 centrifuges at Natanz and set Iran's nuclear program back by about a year.
asserted
Stuxnet → destroy → year
Such attacks make global headlines when they are discovered, causing policymakers to make sweeping statements at press conferences.
But, Dr Rajagopalan said, political momentum was often lost after the fact.
asserted
momentum → make → fact
"Somehow it seems all very theoretical, sounds very futuristic,"she said.
asserted
it → seem → ?
"You don't want to scare people away, but at the same time, people need to understand that there are consequences to these attacks, that these attacks are real.
asserted
attacks → want → attacks
"
Critical infrastructure a sitting duck
asserted
infrastructure → sit → ?
How is it that the most critical infrastructure in the world is so at risk of being hacked?
asserted
infrastructure → hack → risk
UQ cyber security expert Ryan Ko said the main issue with OT was that much of it had been installed 20 to 30 years ago before existing knowledge of the latest cyber threats.
asserted
much → say → threats
The old legacy systems were increasingly connected to the internet, he said, and every piece of critical infrastructure connected with OT was at risk.
asserted
piece → connect → risk
And with the rise of AI, the scope of cyber-attacks had "changed drastically".
"It is now easier for an adversary to automatically detect a previously unknown vulnerability," Professor Ko said.
asserted
Ko → change → vulnerability
…and 11 more, not listed.
The Aporia