SOCI Act And Cyber Security: Australian Lessons From France’s Connected Device Attack

On the night of 11 October 2026, cyber attackers reached into hundreds of French supermarkets and told the fridges to warm up. No one forced a door or broke a window. They simply logged in to the controllers that run the refrigeration remotely, forced the refrigerators into defrost for about six hours, and pushed temperatures towards 50°C. Stock spoiled, some equipment caught fire, and the losses ran into the tens of millions of euros.

For Australian boards, there is an important lesson: the same exposure sits across Australian infrastructure and businesses, and for critical infrastructure, the law already requires us to manage it.

The cyberattack in France

Overnight on 11 to 12 October 2026, attackers remotely drove supermarket refrigeration controllers into defrost mode across several chains. Les Mousquetaires reported around 150 Intermarché stores affected; Carrefour about 80; Monoprix roughly 30; and Coopérative U close to 100, although many held the cold chain and lost