Cybercriminals Target Physical Building Systems to Force Ransom Payments

When attackers pivot from encrypting file shares to manipulating refrigeration, HVAC, and door access controls, the stakes of a corporate intrusion shift instantly from data loss to physical safety. A recent wave of incidents—including a late Sunday night attack that compromised thousands of remote-controlled refrigeration units across hundreds of French grocery stores, spiking temperatures, spoiling food, and sparking fires—highlights how cybercriminals are targeting building automation systems (BAS) to maximize extortion pressure.

Physical Systems as the New Extortion Leverage

Historically, extortion relied on encrypting databases or threatening to leak exfiltrated sensitive files. However, threat actors have realized that interrupting physical facility operations generates far more immediate executive panic. Building automation systems manage the convergence of IT and operational technology (OT), controlling critical services like HVAC, water distribution, door locks, badge readers, lighting, and fire suppression panels.

When adversaries hijack these physical controls, the consequences are immediate and visible. In recent real-world cases, a ransomware attack against a Canadian hospital disrupted central HVAC monitoring, badge card issuance, and electronic door locks. In another incident detailed by incident responders at Semperis, attackers locked out an entire corporate facility after the victim refused to negotiate, forcing law enforcement to physically break windows to grant staff re-entry. Similar operational shutdowns occurred when attacks hit Las Vegas casinos, disabling electronic keycards, payment kiosks, and slot machines.

How Attackers Exploit and Hide in Building Automation Systems

BAS environments represent an attractive target for threat actors primarily because they sit at the exposed intersection of IT and OT networks, often with minimal security controls. A report published by ServiceNow’s Armis Labs reveals that 73 percent of surveyed organizations have building automation systems that have been targeted in ransomware attacks, and 73 percent maintain known exploited vulnerabilities within their BAS footprint.

The core vulnerability in BAS infrastructure stems from insecure legacy protocols and flat network architecture. According to the research, 91 percent of building automation systems communicate over unencrypted, unauthenticated protocols—such as unsegmented BACnet, Modbus, or legacy web interfaces designed decades ago without security in mind. Because these controllers require continuous uptime, organizations rarely patch them or perform vulnerability scans, fearing unexpected operational downtime.

Threat actors exploit this gap not just to cause physical havoc, but as a persistent hiding place. As noted by threat research at ServiceNow, attackers frequently breach low-profile BMS units to establish persistent backdoors into an enterprise. Even when incident responders detect and sever an intruder’s presence on the primary IT network, the unmonitored BMS provides a reliable, hidden foothold to pivot back into administrative environments, as was recently observed in an attack against a major financial institution.

The Generative AI Threat Multiplier for OT

The technical barrier to entry for manipulating specialized industrial control systems and legacy RTOS platforms is dropping rapidly. Historically, exploiting industrial platforms running real-time operating systems like VxWorks or legacy Unix derivatives required deep specialized knowledge of proprietary protocols, hardware registers, and control logic. Attackers were often hesitant to alter physical parameters blindly out of fear of crashing systems prematurely or failing to achieve the desired extortion outcome.

Generative AI tools are eliminating this steep learning curve. Attackers now leverage AI models to analyze obscure hardware documentation, decipher proprietary register maps, and generate precise command sequences for unfamiliar devices. Whether identifying decades-old vulnerabilities in legacy firmware or calculating exact setting shifts required to imbalance automated logistics systems, AI enables non-specialist attackers to reliably execute targeted physical disruption without needing years of dedicated OT expertise.

Industry Impact and Blast Radius

Data tracked by OT security firm Dragos demonstrates an accelerating trend across the industrial landscape. Ransomware attacks on industrial organizations jumped 49.5 percent in 2023 to 995 incidents, followed by an 87 percent increase in 2024, with active threat groups targeting the sector expanding from 50 to 80. By 2025, 119 ransomware groups impacted over 3,300 industrial organizations. That momentum has continued into 2026, recording 1,020 industrial incidents in Q1 and 1,140 in Q2 alone.

The realistic blast radius of a BAS compromise varies by sector:

• Healthcare: Lockouts, HVAC disruption, and loss of environmental monitoring in operating rooms or pharmaceutical storage.
• Retail & Cold Chain: Mass temperature manipulation causing inventory loss, equipment damage, and fire hazards.
• Manufacturing: Total halt of assembly lines, as seen during the August 2025 breach at Jaguar Land Rover (JLR), which halted production and crippled business operations for months.
• Commercial Real Estate: Physical lockout of employees, unsafe environmental conditions, and compromised facility security controls.

Despite these catastrophic outcomes, Dragos estimates that fewer than 10 percent of OT networks worldwide currently maintain adequate network monitoring.

Hardening BAS and Operational Technology

Mitigating risks in building automation requires treating BAS and BMS devices as high-risk OT assets rather than standard office peripherals:

• Network Microsegmentation: Enforce strict microsegmentation between IT networks and BAS networks using firewalls configured to block unauthorized cross-zone traffic and restrict administrative access to dedicated jump hosts.
• Disable Exposed Management Interfaces: Ensure BACnet, Modbus, LonWorks, and web management interfaces are never exposed directly to the public internet; enforce multi-factor authentication (MFA) via encrypted VPNs or Zero Trust Network Access (ZTNA) for remote vendor maintenance.
• Passive OT Network Monitoring: Deploy specialized OT passive network monitoring tools capable of inspecting industrial protocol traffic for abnormal command structures, unauthorized logic updates, or unexpected register reads/writes without risking system downtime.
• Credential and Interface Hygiene: Audit default passwords and hardcoded accounts across all field controllers, thermostats, door controllers, and BAS gateways, disabling unnecessary remote management protocols and interactive shells.