Cybercrims go beyond stealing data to attack physical building systems

'Hold my beer, have fun getting into your offices' Jessica Lyons Jessica Lyons Cybersecurity Editor Published sat // UTC Networking problems after the October 2026 Windows update? NTLM might be to blame 1 day ago Uncle Scam Wants You … to cough up your cash and personal data, FBI warns ahead of midterms 1 day ago Attack on BAE-managed system disrupts US bankruptcy courts 1 day ago Thief snatches school snapper's SD cards in smash & grab 1 day ago User refused to change her password because everyone already knew it 1 day ago Late Sunday night, a still-unknown cybercriminal or group hacked thousands of remote-controlled refrigeration systems across hundreds of French grocery stores, spiking temperatures, spoiling food, and sparking fires. This is part of an ongoing trend of attacking physical systems that can do damage in the real world. In August, a ransomware attack disrupted building-management systems at a Canadian hospital, affecting door access controls, central HVAC monitoring, and the issuing of staff access cards. And three years ago, cyberattacks hit Las Vegas casinos, causing slot machines to go dark, preventing payment kiosks and ATMs from spitting out cash, and locking guests out of their rooms when the electronic keys stopped working. Not all digital intrusions remain in cyberspace, and attackers don’t need to encrypt files and steal data to cause chaos. We asked if the customer paid the ransom demand, and Beasley yelled: “Oh, hell, no!” A report published earlier this month by ServiceNow’s Armis Labs found increasing evidence of ransomware attackers using physical consequences as leverage in their intrusions. “Today’s BAS operate at the intersection of IT and OT worlds, creating unprecedented exposure,” the report said. Ransomware with physical consequences Building automation systems - BAS - are the critical systems that control and monitor facilities’ HVAC, lighting, energy usage, and water consumption. They also oversee badge readers, door locks, surveillance cameras, fire alarm control panels, and other physical safety equipment.  As such, BAS make very attractive targets for ransomware operators looking for high-pressure ways to extort organizations into paying multi-million ransom demands. These systems also appeal to government-backed goons and hacktivists looking to ensure maximum psychological and physical impact during destructive cyberattacks.  Armis Labs found 73 percent of organizations own BAS that have been used in ransomware attacks, and this same percentage have known exploited vulnerabilities in at least one of their building automation systems. Additionally, 91 percent of BAS communicate over insecure protocols - opening up an even bigger attack surface for cyber-miscreants wanting to cause physical harm. “The primary thing that we see with any attack on building management systems or physical systems: It’s a great place for the threat actor to hide,” Michael Freeman, ServiceNow’s senior director of threat research, told The Register. “It's easier for them to compromise, and it's easier for them to hide in.” BAS and operational technology (OT) in general have fewer security controls than IT systems.