Ransomware gangs spark fires and spoil food by hijacking building controls to extort firms
Criminals are targeting physical access controls and HVAC systems, creating real-world chaos to pressure executives into paying extortion demands.
Key points
- Attackers hacked refrigeration systems in French grocery stores, causing food spoilage and fires.
- A Canadian hospital suffered disruptions to door access and HVAC monitoring during a ransomware attack.
- Semperis consultants reported an incident where police had to smash windows to re-enter a locked building.
Cybercriminals are increasingly targeting physical building management systems to create tangible disruptions, moving beyond traditional data theft and file encryption. This trend affects organisations that rely on integrated IT and operational technology environments. Attackers exploit these connections to cause chaos in the real world, such as spiking temperatures or locking staff out of premises. The goal is to raise the stakes for executives, making the operational impact severe enough to force ransom payments.
The risk
The primary risk involves the convergence of information technology and operational technology. A report from ServiceNow’s Armis Labs states that building automation systems operate at this intersection, creating unprecedented exposure. Attackers do not need to steal data to cause significant damage. By manipulating physical systems, they can disrupt daily operations, compromise safety, and create urgent pressure on management. This approach turns a digital intrusion into a physical emergency, complicating incident response and increasing the likelihood of financial extortion.
Who is exposed
Organisations with connected building infrastructure are exposed to these threats. Late Sunday night, remote-controlled refrigeration systems at hundreds of French grocery stores were hacked, leading to temperature spikes, food spoilage, and fires. In August, a Canadian hospital experienced disruptions to door access controls, central HVAC monitoring, and staff access card issuance during a ransomware attack. Three years ago, Las Vegas casinos faced similar issues, with electronic keys failing and payment kiosks stopping cash dispensing. These examples show that retail, healthcare, and hospitality sectors are vulnerable.
Cost and compliance
The financial and operational costs of these attacks extend beyond ransom demands. Tim Beasley, a senior incident response consultant at Semperis, described an incident where a customer refused to pay. The threat actor locked everyone out of the offices. Police had to break windows to allow entry, resulting in property damage. Beasley confirmed the customer did not pay the ransom. This highlights that physical damage and emergency services costs can occur regardless of whether extortion demands are met. Compliance risks may also arise if safety systems like HVAC or access controls are compromised during an attack.
What happens next
Managers should review their building automation systems for integration points with IT networks. Ensure that physical access controls and environmental monitoring systems have separate security protocols. Monitor for unusual activity in these systems, as attackers may use them as leverage. Prepare incident response plans that include physical entry contingencies, such as manual override procedures or coordination with local authorities.
Questions to ask your suppliers
Organisations should inquire whether their building management systems are segmented from core IT networks. Ask suppliers if they monitor for unusual access patterns in physical control systems. Determine who within the organisation receives alerts for HVAC or access control anomalies. Check if suppliers provide guidance on manual override procedures during a cyber incident. Ensure that incident response plans include steps for physical re-entry if digital locks fail. Teams usually need to coordinate with facilities management and security providers to address these physical risks effectively.
What to do and how to stay safe: building management systems
- Audit all building automation systems for unnecessary connections to corporate networks.
- Implement strict access controls for HVAC and door management interfaces.
- Develop manual procedures for building entry in case of digital lockouts.
- Train staff to recognise signs of physical system compromise, such as temperature fluctuations.
Step-by-step guide: Phishing Myths Debunked: Why Common Beliefs Leave You Vulnerable
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why are attackers targeting building systems instead of just stealing data?
Attackers use physical disruptions to create urgent operational crises, pressuring executives to pay ransoms faster.
Which industries are most at risk from these attacks?
Retail, healthcare, and hospitality sectors have been targeted, as seen in French grocery stores, Canadian hospitals, and Las Vegas casinos.
Can physical damage occur even if the ransom is not paid?
Yes, police may need to break windows or doors to re-enter buildings, causing property damage regardless of payment.
