SOCI Act and cyber security: Australian lessons from France’s connected device attack

On the night of 11 October 2026, cyber attackers reached into hundreds of French supermarkets and told the fridges to warm up. No one forced a door or broke a window. They simply logged in to the controllers that run the refrigeration remotely, forced the refrigerators into defrost for about six hours, and pushed temperatures towards 50°C. Stock spoiled, some equipment caught fire, and the losses ran into the tens of millions of euros. 

For Australian boards, there is an important lesson: the same exposure sits across Australian infrastructure and businesses, and for critical infrastructure, the law already requires us to manage it.

The cyberattack in France

Overnight on 11 to 12 October 2026, attackers remotely drove supermarket refrigeration controllers into defrost mode across several chains. Les Mousquetaires reported around 150 Intermarché stores affected; Carrefour about 80; Monoprix roughly 30; and Coopérative U close to 100, although many held the cold chain and lost little. Impacts were reported in Spain, Portugal, Poland, Germany and Belgium. Paris prosecutors opened an investigation into a large-scale cyberattack, and France's national cyber emergency team, CERT-FR, told operators to disconnect the affected controllers or tightly filter access to them.

The entry point has not been confirmed, and the retailers framed the incident as a compromise of systems managed by their refrigeration supplier. The vendor, Danfoss, said most affected units were end-of-life models that no longer receive security updates, together with some current controllers running outdated firmware. This is one of the clearest examples yet of attackers directly manipulating operational technology at scale, not by encrypting files or stealing data, but by physically altering how equipment behaves across hundreds of sites in a single night.

The cyberattack was predictable

Two months earlier, in August 2026, Claroty’s industrial cyber research team published findings on these very controller families. In the Danfoss supervisory controller, it found three vulnerabilities, including a hidden 'code-of-the-day' feature that generates a daily password from the device's clock. Anyone who reverse-engineered it could bypass the login entirely. In a second, widely deployed platform it found 23 vulnerabilities, 21 of them of high severity, that could be chained to seize control of a controller from the internet without credentials. Both vendors issued patches. The researchers also found 2,765 of the Danfoss management interfaces answering directly to the open internet. The research measured the exposure, and the attack realised it.

Not just a French problem, and not just a food problem

This story matters for Australia, well beyond supermarkets. The same supervisory controllers, building-management systems and SCADA equipment that manage refrigeration also sit behind:

• energy and gas facilities, and water and wastewater treatment plants;
   
• freight, logistics and cold-chain operators moving temperature-sensitive goods;
   
• data centres, where precise cooling is mission-critical; and
   
• hospitals and pharmaceutical supply chains that depend on controlled temperatures.

Nozomi Networks' February 2026 report ranked Australia as the most targeted country for operational technology and connected-device attacks by alerts per organisation, up from third. Manufacturing, transport, energy and utilities, and healthcare consistently sit among the most targeted sectors. The common thread is the architecture: remote sites, cellular links for maintenance, ageing controllers and management consoles left exposed to the internet, where anyone with freely available scanning tools can find them. That profile describes operational technology across almost every sector covered by the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act). While cyber security practices have, for a period of time, focused on the security of personal information and other data, attacks on operational technology and Internet of Things (IoT) devices can have immediate economic consequences, as demonstrated by the cyberattacks suffered by DP World in 2023, and the flow on effects through Australia’s ports. 

Australia’s laws already apply to critical infrastructure, but with gaps

The SOCI Act covers 11 sectors. It imposes positive security obligations on responsible entities to: 

• provide ownership and operational information to the asset register;
   
• report cyber security incidents to the Australian Signals Directorate’s Australian Cyber Security Centre (critical incidents within 12 hours of becoming aware, other reportable incidents within 72 hours); and
   
• adopt, maintain and comply with a critical infrastructure risk management program (CIRMP).  

Where the relevant asset definitions and thresholds are met, a refrigeration, building-management controller or any other critical operational technology, its interface and the network connecting it are likely to form part of a critical infrastructure asset wherever the obligations are switched on for that sector.

The Enhanced CIRMP Rules commenced on 10 June 2026. They require entities to address legacy and emerging technology risks, deploy phishing-resistant multi-factor authentication, segregate critical from non-critical systems, and manage supply chain and insider risk. There are staged deadlines of 10 June 2027 for new material-risk measures and 10 June 2028 for the balance. 

Critically, the enhanced rules apply to most of the asset classes that depend on operational technology, including electricity, gas, energy market operator assets, liquid fuel, water, freight infrastructure and freight services. However, they do not yet apply to food and grocery, which remains on the base CIRMP. In other words, the sector that has just handed the world its wake-up call is the one the enhanced regime does not currently reach, while the energy, water and transport operators running near-identical equipment are already on a legislated path to the higher standard. 

The new product security regime does not fill the gap either. Since 4 March 2026, the smart device standard under the Cyber Security Act 2024 (Cth) has required unique or user-defined passwords that cannot be derived from publicly available information or guessed, a published channel for reporting vulnerabilities, and a published support period for security updates. These are analogous to the weaknesses exposed in France: a ‘code-of-the-day’ password and controllers left without updates. The smart device standard, however, applies only to consumer-grade devices intended for personal, domestic or household use. Operational technology such as commercial refrigeration, building-management and industrial controllers is not subject to equivalent requirements. In any event, the standard places obligations on manufacturers and suppliers rather than the businesses that operate the devices. 

Enforcement is rising and penalties may follow

From 2026-27, the Cyber and Infrastructure Security Centre (CISC) is moving from education to enforcement, using regulatory guidance notices, formal non-compliance notices and infringement notices. That shift follows the 2026 Independent Review of the SOCI Act, whose six recommendations the federal government accepted in principle.

The penalties bite harder than the headline numbers suggest. Responsible entities are typically bodies corporate, and a court may impose up to five times the specified civil penalty on a body corporate. At the Commonwealth penalty unit value of A$364 from 1 July 2026, the maximum penalty per contravention for CIRMP non-compliance (200 penalty units) is about A$364,000, for late incident reporting or register failures (50 units each) about A$91,000 and for annual report failures (150 units) about A$273,000. Because a failure to report or notify on time is a continuing contravention, each day of delay can be a separate contravention. 

The proposed Tranche 2 reforms to the SOCI Act, on which consultation closed on 31 July 2026, would:

• lift the maximum for core preventive and assurance duties from 200 to 500 penalty units, around A$910,000 for a corporation;
   
• introduce a 'relevant operator' concept that could capture managed service providers and equipment makers with practical control over an asset; and
   
• require independent assurance of CIRMPs. 

These are proposals only and are not yet law. 

Beyond fines, a board that signs an annual CIRMP report while legacy controllers sit unpatched and exposed to the internet would face difficult questions in any later inquiry. Tranche 2 reforms to the SOCI Act also propose removing the current restriction that keeps those annual reports out of civil penalty proceedings.

A significant incident could also attract review under Part 5 of the Cyber Security Act 2024 (Cth). On referral, the Cyber Incident Review Board (whose Chair took office on 1 May 2026) may review incidents that: 

• seriously prejudice, or could reasonably be expected to seriously prejudice, Australia’s social or economic stability, defence or national security;
   
• involve novel or complex technologies; or
   
• are of serious concern to the Australian people.

A coordinated, remote manipulation of operational technology across hundreds of sites would be a strong candidate for review. The Chair can request information and, after a request, require an entity involved in the incident to produce documents. Its final reports must not apportion blame, but they are published, and they will set out the contributing factors.

Outside the SOCI net, but not outside the risk 

Businesses and industries outside the regulatory scope of the SOCI Act are just as dependent on critical operational technology systems, such as IoT devices. Building security and management systems and supervisory controllers are deployed widely in hotels, pubs, clubs and casinos; shopping centres and office towers; food and beverage manufacturers, wineries and dairies; ice rinks, aquatic centres and stadiums, and aged-care facilities. They are also used by many warehousing and logistics operators, private hospitals and commercial data centres and server rooms. (Not all of these will fall within SOCI). Businesses outside the SOCI regime carry none of its compliance scaffolding, but they face the same practical exposure: spoiled stock and food-safety breaches, fires and work health and safety incidents, and days of business interruption – all able to be triggered remotely by someone who never comes near the site. These businesses remain subject to general laws: directors' duties of care and diligence (which ASIC regards as extending to cyber risk), work health and safety laws, the Australian Consumer Law and ransomware payment reporting under the Cyber Security Act 2024 (Cth) (where applicable). In addition, insurers increasingly scrutinise or exclude cyber-related loss. 

What to do now to prevent cyberattacks

For boards and executives:

Ensure that your company:

• inventories every controller and its firmware, and patches or retires end-of-life hardware;
   
• assesses the role of IoT controllers in business critical functions and addresses potential compromises in business continuity plans;
   
• treats operational technology (including refrigeration and other operational-technology controllers) as security-critical assets, owned and governed within its cyber program, not just facilities equipment;
   
• runs the researchers' own test and searches the public scanners for its own management interfaces;
   
• segregates operational technology from corporate IT and deploys phishing-resistant multi-factor authentication;
   
• (where SOCI applies) builds and rehearses incident response for operational-technology scenarios against the 12-hour and 72-hour reporting clocks;
   
• workshops the potential work health and safety risks of remotely triggered equipment failures;
   
• reviews its insurance program to confirm whether cyber-triggered physical damage and business interruption are covered; and
   
• updates incident response plans and simulations (and increase software patching speed) to address AI-enabled attacks that move at machine speed, particularly against legacy operational technology. 

For legal counsel:

• map every group entity against the SOCI asset definitions, including direct interest holders;
   
• test CIRMP content against the Enhanced Rules' hazard categories, even where your sector is not yet caught;
   
• push the obligations down the supply chain through contract, as vendor assessment and supply chain mapping already require; and
   
• track the Tranche 2 exposure draft, in particular the relevant-operator concept, the higher penalties and the change to admissibility of annual reports.

The bottom line

The French attack was not a freak event. Published vulnerabilities, thousands of exposed devices and ageing hardware that was never replaced were all exploited in a single night. Australia has the law, the regulator and the warning. The open question is whether operators act on their obligations before the next incident forces them to.