When Ransomware Locks the Doors: Cybercriminals Target Building Systems

Cybercriminals are moving beyond stealing and encrypting data to attack the systems that run physical buildings. The Register reports that late on a recent Sunday night, an unknown attacker or group hacked thousands of remote-controlled refrigeration systems across hundreds of French grocery stores, spiking temperatures, spoiling food and sparking fires. In August, a ransomware attack disrupted building-management systems at a Canadian hospital, affecting door access controls, central HVAC monitoring and staff access cards. Three years ago, attacks on Las Vegas casinos darkened slot machines, stopped cash machines and locked guests out of their rooms.

The tactic raises pressure on executives to pay. Tim Beasley, a senior incident response consultant at Semperis, described one case where a customer refused to pay and the attacker locked everyone out of the offices. Police had to break windows so the customer could get back in. The customer did not pay.

A report published earlier this month by ServiceNow's Armis Labs found growing evidence of ransomware attackers using physical consequences as leverage. Building automation systems control and monitor heating and cooling, lighting, energy and water use, as well as badge readers, door locks, cameras and fire alarm panels. The report says these systems sit where IT and operational technology meet, creating unprecedented exposure.