A late-night attack on thousands of remote-controlled refrigeration systems across French grocery stores is the latest example of cybercriminals moving beyond data theft. The hackers spiked temperatures, spoiled food, and sparked fires. Similar incidents have hit a Canadian hospital's building management systems and Las Vegas casinos, where attackers locked guests out of rooms and disabled ATMs.
Building automation systems (BAS) control HVAC, lighting, door locks, surveillance cameras, and fire panels. They are attractive targets because physical consequences create intense pressure to pay extortion demands. Tim Beasley of Semperis described a case where a non-paying customer was locked out of its offices until police broke windows to let staff back in.
A report from Armis Labs found that 73% of organizations own BAS that have been used in ransomware attacks, and the same percentage have known exploited vulnerabilities in at least one such system. Additionally, 91% of BAS communicate over insecure protocols. ServiceNow's Michael Freeman noted that BAS are easier to compromise and easier for attackers to hide in than typical IT systems.
Freeman also said attackers are using AI to understand obscure building automation systems, including those running VxWorks and older Unix-like operating systems. This means criminals no longer need to be OT experts to carry out destructive attacks, and security through obscurity is no longer a defense.