As rail networks become increasingly connected, operators must balance the benefits of digital innovation with the growing cybersecurity risks facing critical infrastructure. In this thought leadership article, David Hope, Regional Vice President of APJ for Nozomi Networks, explores the vulnerabilities created by ageing operational technology systems and explains why rail operators must take a proactive approach to cyber resilience.
Australia’s rail networks carry millions of passengers and billions of dollars in freight each year, yet the operational technology systems that keep those trains running safely are, in many cases, decades old.
This creates obvious cybersecurity vulnerabilities. Just as you wouldn’t expect the first computer to withstand modern threat actors, we shouldn’t expect systems designed in the 1970s and 1980s to withstand new, often AI-enabled attack methods.
Most of Australia’s rail signalling and control systems were designed and built decades before cybersecurity became a necessary industry and in almost all cases, these systems were not designed to be networked, i.e. connected to the internet.
But technology has advanced and suddenly, real benefits emerged in connecting these systems together and to the web. By joining these legacy systems to wider IT systems, cloud networks and third-party vendors, rail companies can now use remote monitoring and control, real-time traffic management, automatic obstacle detection and even allow trains to communicate directly with each other.
This has changed the game for rail networks. Instead of operators having to physically visit rural locations, suddenly they could operate and manage industrial processes from anywhere, at any time. This reduces travel costs while improving response times in an emergency.
Unfortunately, it also ties a system that never had cybersecurity built into its processes, into the wider IT network. To top it off, often, these systems are being integrated faster than security frameworks can keep up. Every entry point or point of connection, can be a risk – a way threat actors can gain access to an abundance of data and systems.
So far, Australia has largely been able to avoid these kinds of attacks. This might make some people sceptical about the likelihood of a nefarious attack taking place. But we don’t have to look far to find these methods have been used time and time again across the world.
In 2022, pro-Russian groups targeted railway signalling systems across Europe. One instance included the hacking of Poland’s railway system, a critical network for NATO supplies into Ukraine.
The saboteurs didn’t use a particularly sophisticated attack method. Instead, they were able to halt both freight and passenger networks across the country through a simple radio command, triggering the train’s emergency stop function.
The attack not only stopped over 20 trains, but it also included broadcasting Russia’s national anthem and a speech by Vladimir Putin. Unsurprisingly, the incident raised questions about legacy radio systems.
This attack method was recently replicated by a 21-year-old student in Taiwan. On April 5 2026, the student exploited a cryptographic flaw in Taiwan High-Speed Rail’s TETRA networks to send a forged general alarm signal. This alarm caused four trains at up to 300 km/h to emergency stop for 48 minutes.
Like the case in Poland, this attack did not require a sophisticated network intrusion or a new zero-day vulnerability, but rather some consumer-grade SDR equipment and handheld radios, used to exploit a system operating for 19 years without updating cryptographic keys or authentication.
Operational technology or OT systems can be easier to compromise and once connected to the network, nefarious actors can use this as a way to infiltrate wider networks.
In Australia, our rail networks, from metropolitan transit authorities to long-haul freight operators, run on these types of systems. We are not exempt. We are simply not yet the headline.
While geographically isolated, from an intelligence perspective, our global alliances and intelligence partners may, indeed, make our critical infrastructure networks a strategic target.
That’s part of the reason why, in 2022, the Security of Critical Infrastructure (SOCI) Act was expanded to include transport – and therefore rail – as a critical infrastructure asset.
This requires operators to register critical assets with the Department of Home Affairs, maintain detailed ownership and operational information and most importantly, develop a critical infrastructure risk management programme to identify hazards across cyber, physical, supply chain and personnel domains.
But due to the continuously evolving nature of threat actors, compliance with the SOCI Act may not be enough to keep Australia’s rail networks secure.
The good news is that there are several ways rail operators can go beyond the SOCI recommendations. Rail operators can create an inventory of operational technology assets, including train control systems, building systems and IoT devices – this can help organisations pinpoint the operational risks that would have the widest consequences.
This approach allows operators to scale continuous monitoring processes across the network. By taking such measures, Australian rail operators can see potential threats before they wreak havoc.
Because the question is no longer whether a serious attack on our rail infrastructure is possible, it’s how we can catch the perpetrators off guard when it happens.
