Cybercriminals Target Building Automation Systems to Drive Physical Extortion

Cybercriminals and ransomware operators are aggressively moving past traditional data exfiltration and file encryption to directly hijack physical infrastructure and building automation systems (BAS). By taking control of HVAC units, badge readers, physical door locks, industrial refrigeration, and operational technology (OT) hardware, attackers are executing physical disruptions that force immediate executive compliance with extortion demands. Recent real-world incidents—including a breach hijacking remote refrigeration systems across hundreds of French grocery stores to spike temperatures and spoil inventory, as well as an August ransomware attack disrupting door access controls and central HVAC monitoring at a Canadian hospital—highlight how deeply integrated physical safety systems have become in the modern threat landscape.

The Shift to Physical Extortion

For years, ransomware threat actors relied almost exclusively on encrypting IT databases or threatening to leak confidential business records on dark web leak sites. However, as organizations improve offsite backup resilience and incident response capabilities, extortionists are exploiting building management systems (BMS) to exert maximum operational pressure.

When targets refuse to pay financial demands, threat actors increasingly turn physical building controls against the business. Incident response engagements, such as those handled by Semperis, have seen ransomware operators lock entire corporate workforces out of facilities by revoking digital badge access and overriding physical door controls, leaving organizations reliant on local police breaking physical windows to regain access to their own offices. Similar physical chaos unfolded during the Las Vegas casino intrusions, where compromised building and gaming systems went dark, payment kiosks stopped dispensing cash, and electronic room keys left guests locked out of their rooms.

Why BAS and OT Infrastructure Are Highly Exposed

Building automation systems operate at the critical intersection of IT networks and physical facility management, governing heating, ventilation, air conditioning, energy usage, water consumption, surveillance cameras, fire alarm control panels, and physical door access. Despite their central role in daily operations, these environments present severe structural vulnerabilities:

• Insecure Protocols: Research published by ServiceNow’s Armis Labs reveals that 91 percent of BAS communicate over unencrypted, cleartext legacy protocols that lack native authentication mechanisms.
• Unpatched Exploits: The same report found that 73 percent of surveyed organizations operate BAS containing known exploited vulnerabilities, with 73 percent reporting that their building automation systems have already been targeted in ransomware attacks.
• Evasion and Persistence: Because OT and BMS hardware require continuous uptime, security teams rarely run vulnerability scanners, apply routine security updates, or deploy endpoint detection and response (EDR) agents on these devices. As Michael Freeman, ServiceNow’s senior director of threat research, notes, attackers routinely compromise BMS environments to hide quietly, establish persistent backdoors, and pivot back into the broader IT enterprise whenever they are booted from corporate networks.

AI Lowering the Technical Barrier to OT Attacks

Historically, industrial control systems and operational technology were partially protected by their obscurity. System architectures relied on specialized hardware, custom software, and real-time operating systems such as VxWorks or legacy Unix derivatives. Weaponizing these systems required deep domain expertise and custom exploit engineering that financially motivated ransomware operators were rarely willing to invest for opportunistic attacks.

Artificial intelligence has largely erased this implicit defense. Threat actors are now using AI tools to quickly parse obscure operational technologies, understand proprietary control logic, and interpret complex protocols without needing formal engineering backgrounds. Rather than risking an unintended system crash that alerts defenders, attackers leverage AI models to determine precise parameter changes—such as manipulating weight distribution logic in airline cargo applications or altering operational limits on commercial cooling systems—to inflict maximum physical impact.

Sustained Growth in Industrial Extortion

Data tracked by OT security provider Dragos confirms a massive, multi-year escalation in ransomware claims and physical compromises across industrial organizations and critical facilities:

• Escalating Incident Rates: Dragos tracked 995 ransomware attacks against industrial organizations in 2023 (a 49.5 percent increase over 2022). That figure surged another 87 percent in 2024.
• Expanding Threat Ecosystem: The number of active ransomware groups targeting industrial organizations expanded from 50 in 2023 to 80 in 2024. By 2025, Dragos identified 119 groups impacting over 3,300 industrial organizations.
• 2026 Volume: The trend has continued through 2026, with Dragos recording 1,020 industrial incidents in Q1 and 1,140 in Q2.

While major supply chain disruptions—such as the August 2025 Jaguar Land Rover (JLR) breach that halted vehicle manufacturing for months—demonstrate the severe impact of targeted OT attacks, the vast majority of incidents remain opportunistic. Attackers scan for internet-exposed control panels and unsegmented management interfaces, capitalizing on the reality that fewer than 10 percent of OT networks worldwide currently maintain adequate network visibility or continuous monitoring.

Mitigating Building Automation Risks

To prevent BAS and OT compromises from paralyzing physical facilities or compromising enterprise IT networks:

1. Enforce Strict Network Segmentation: Isolate all building management systems, access control panels, and HVAC controllers into dedicated, firewalled VLANs with strict zero-trust access controls that block inbound connectivity from the corporate IT domain or the public internet.
2. Transition Away from Cleartext Protocols: Where supported, implement encrypted variations of building protocols (such as BACnet Secure Connect / BACnet/SC) and disable unauthenticated remote management interfaces on all field controllers and network gateways.
3. Deploy Specialized OT Network Monitoring: Implement passive, non-intrusive network detection and response (NDR) monitoring calibrated for BAS/OT protocols to detect unauthorized parameter changes, rogue controller connections, and cross-domain lateral movement without risking operational downtime.