Hacking Is the New Front in Modern Conflict as Operational Technology Becomes a Target

In 2000, a new water treatment facility on the banks of the Maroochy River, on Queensland's Sunshine Coast, kept misbehaving. Radio links to the wastewater pumps failed, and the alarms meant to warn staff stayed silent. Over three months, more than 800,000 litres of untreated sewage flowed into local waterways. Council staff first put it down to teething problems at a new plant. The cause was a hacker.

The same year Australia hosted the Olympics, it also became home to the first attributable case of operational technology hacking. Engineers, academics and governments still study it. Operational technology, or OT, is the hardware and software that monitors and controls physical machines: power plants, conveyor belts, traffic lights, air traffic control and water treatment plants.

The Maroochy incident is 26 years old, but an ABC analysis argues that OT attacks are now rising and are likely to be supercharged by AI. The recent list is varied. Earlier this month, hackers remotely raised the temperatures of fridges and freezers across hundreds of French supermarkets. In July, 30 water systems in the United States were attacked, in a manner consistent with the Iranian-backed group CyberAv3ngers. In June, a cyber incident halted Australia's second-largest raw sugar producer, stopping milling and cane haulage; a Russian-speaking group called The Gentleman claimed it. In March, the Handala Hack group, also said to operate under the Iranian government, claimed attacks on medical supplier Stryker.

Since US President Donald Trump launched the war in Iran, the US Cybersecurity and Infrastructure Security Agency has warned of "ongoing Iranian-affiliated cyber targeting." The article frames this as cyber-retribution, with hacking becoming a new front between adversaries. The Stryker attack was said to be retaliation for the bombing of an elementary school in southern Iran. Though it hit a US company, it put Australian hospitals on alert because it remotely wiped associated devices worldwide.

The stakes climb with the targets. In 2025, China-sponsored hackers breached more than 400 agencies worldwide through Microsoft's SharePoint, including the US National Nuclear Security Administration, which manages the American nuclear stockpile and the reactors on warships and submarines. That was an IT breach, not an OT attack, but Raji Rajagopalan of the Australian Strategic Policy Institute said such footholds can be used later. Hackers, she said, "get into a system, lie dormant for a very long time and when there is an opportunity, get into sensitive areas."

Nuclear facilities rely on air gaps, keeping administrative systems largely disconnected from operating ones. Dr Rajagopalan said the separation is not watertight: digital upgrades and remote monitoring "always compromise that air gap." The proof of concept is Stuxnet, a sophisticated worm created under Operation Olympic Games, a secret US-Israeli sabotage campaign the US government has never publicly acknowledged. It sat undetected in Iran's Natanz facility between 2009 and 2010, driving uranium-enrichment centrifuges out of control until they broke, while concealing what it was doing. It destroyed at least 1,000 centrifuges and set Iran's program back about a year. She noted that such incidents prompt sweeping statements from policymakers, but political momentum often fades afterward.

Why is OT so exposed? University of Queensland cyber security expert Ryan Ko said much of it was installed 20 to 30 years ago, before today's threats were understood, and these legacy systems are increasingly connected to the internet. AI has "changed drastically" the picture, he said: "It is now easier for an adversary to automatically detect a previously unknown vulnerability." The article points to an OpenAI rogue agent's hack of a Medicare data portal, which alarmed the Australian government, as an example of how efficiently AI finds weaknesses, though it was not an OT attack. An Australian Signals Directorate spokesperson said critical infrastructure and OT are attractive targets for state-sponsored actors, criminals and hacktivists; the agency provides frameworks to help governments and businesses defend against what it calls "increasingly complex and persistent threats."

Dr Rajagopalan warned that as incidents multiply, so does the chance of one spiralling out of control, with neither side wanting a big open-ended conflict. A fracturing world also makes it harder for allies to cooperate. Her suggestion for Australia is to work through multilateral bodies such as ASEAN rather than major powers, bringing together smaller groups of like-minded countries that appeal to international law.