Cybercriminals Attack Physical Building Systems in Latest Extortion Trend

Hackers target refrigeration, door locks and HVAC to pressure victims into paying ransoms

By LineZotpaper

Published17 October 2026

Read Time2 min

An unknown cybercriminal group hacked thousands of remote-controlled refrigeration systems across hundreds of French grocery stores late Sunday night, spiking temperatures, spoiling food and sparking small fires. The attack is the latest example of a rising trend in which digital intrusions target physical infrastructure rather than data, using real-world consequences to maximise leverage over victims.

The French grocery refrigeration breach adds to a pattern of attacks on building automation systems (BAS), the critical networks that control HVAC, lighting, energy, water, badge readers, door locks, surveillance cameras and fire alarms. In a similar incident in August, a ransomware attack disrupted building-management systems at a Canadian hospital, affecting door access controls and central HVAC monitoring. Three years ago, Las Vegas casinos suffered cyberattacks that shut down slot machines, payment kiosks and electronic room keys.

"Not all digital intrusions remain in cyberspace, and attackers don't need to encrypt files and steal data to cause chaos," said Tim Beasley, a senior incident response consultant at Semperis. He recalled a case where a client refused to pay and the threat actor locked everyone out of the office building. "The cops had to break in, and literally get into the building, breaking some windows, so the customer was able to finally get back in." Asked if the client paid, Beasley said: "Oh, hell, no!"

A report published this month by ServiceNow's Armis Labs found 73 percent of organisations own BAS that have been used in ransomware attacks, and the same proportion have known exploited vulnerabilities in at least one building automation system. Additionally, 91 percent of BAS communicate over insecure protocols, creating a broad attack surface.

"The primary thing that we see with any attack on building management systems or physical systems: It's a great place for the threat actor to hide," said Michael Freeman, ServiceNow's senior director of threat research. "It's easier for them to compromise, and it's easier for them to hide in." He described a case against a large financial institution where intruders used a building management system to maintain persistent access after being repeatedly ejected from the IT environment.

BAS and operational technology often have fewer security controls than IT systems and require continual uptime, making them harder to patch or scan. The Armis report warns that attackers are also using AI to understand building systems and plan intrusions more effectively.

Analysis

Why This Matters

Physical consequences of cyberattacks escalate rapidly from data loss to safety risks, including spoiled food, locked-out employees and compromised fire alarm systems.
Organisations face increased pressure to pay multi-million ransom demands when operational disruption threatens life or property.
The trend points to a future where attackers routinely bypass IT security by targeting the less-protected building management networks that sit at the intersection of IT and operational technology.

Background

Building automation systems have long been considered separate from corporate IT networks, meaning they often lack the same patching schedules, monitoring and access controls. As organisations connect these systems for efficiency gains, they inadvertently open pathways for attackers. Reports from security firms have documented a steady rise in ransomware groups targeting BAS since at least 2020, with the healthcare, hospitality and financial sectors being among the most exposed.

Key Perspectives

Ransomware operators: They see physical disruption as a high-pressure lever that executives cannot ignore, especially when systems like refrigeration or door locks fail. The ability to hide within BAS also makes detection harder. Victim organisations: Many are unaware of the extent of their BAS exposure and face difficult trade-offs between maintaining system uptime and applying security patches. The financial and operational cost of a breach can exceed the ransom demand. Security researchers: Experts at Armis and Semperis argue that the industry must treat building management systems as critical infrastructure requiring the same security rigor as IT, including network segmentation, vulnerability scanning and incident response plans that account for physical consequences.

What to Watch

Regulatory responses: Will governments require critical infrastructure providers to include BAS in mandatory cybersecurity reporting?
Insurance markets: Insurers may begin demanding proof of BAS security controls before underwriting cyber policies for vulnerable sectors.
Attack sophistication: The use of AI to analyse building blueprints and system configurations could lower the barrier for future physical-disruption attacks.

Sources

Cybercrims go beyond stealing data to attack physical building systems — www.theregister.com - Articles