Cybercriminals hit building systems, not just data, to cause real-world damage

Ransomware operators are targeting building automation systems (BAS) that control HVAC, lighting, energy use, water and even security features, things that keep a building running day to day. These systems often interconnect with badge readers, door locks and surveillance, so a breach can cascade across both physical and digital spaces. Experts say BAS and broader OT (operational technology) environments have fewer security controls and must stay online, making them attractive to criminals looking for high-impact extortion.

When attackers compromise BAS, the potential outcomes aren’t abstract. Food can spoil in minutes if refrigeration is hijacked. Doors can lock people out or lock them in. Hospitals and other critical sites risk delayed care or unsafe conditions. The risk isn’t just “someone stole data” but “someone disrupted your building’s life-supporting systems.”

Tim Beasley, a senior incident response consultant, described a case where a customer faced a multi-pronged intrusion and had to involve police breaking windows to regain access. He stressed that extortion often comes from attackers who want to maximize disruption, not just steal data. Michael Freeman, from ServiceNow’s threat research team, notes the OT side of things tends to be harder to patch and monitor because these systems must stay up, which creates a perfect backdrop for attackers to hide in while they strike IT networks later.

Armis Labs has tracked a worrying trend. Since 2022, ransomware claims against industrial organizations have risen steadily, and more than three-quarters of organizations report BAS in some form has been involved in an attack. A striking 91% of BAS environments are known to use insecure protocols, widening the attack surface for criminals. These insights point to a technology gap between IT security and OT security that criminals are increasingly exploiting.

For readers, the takeaway is practical: if your building or workplace relies on BAS and OT networks, you’ll want stronger segmentation between IT and OT, better access controls, and ongoing monitoring of industrial protocols. This isn’t about a one-off incident; it’s about a shift in how attackers leverage physical systems to pressure organizations into paying multi-million dollar ransoms.

Security teams will likely push for more visibility into BAS, better patching where feasible without interrupting uptime, and clearer incident response playbooks that cover both IT and OT domains. Ransomware groups may continue to adapt, but so can defenders who recognize that protecting physical systems is part of protecting data and people.