> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Ransomware groups target building automation systems to cause physical damage and force payments - URL: https://f4n6.co.uk/security-feed/ransomware-groups-target-building-automation-systems-to-cause-physical-damage-and-force-payments/ - Published: 2026-10-18T11:50:01.000Z - Updated: 2026-10-18T11:50:01.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary A still-unknown criminal group compromised thousands of internet-connected refrigeration units across hundreds of French grocery stores, raising temperatures, spoiling food and starting fires. The incident is the most recent in a pattern of intrusions against building automation systems (BAS) that control HVAC, lighting, door locks, badge readers, surveillance cameras and fire panels, including an August ransomware attack on a Canadian hospital's building-management systems and a case in which intruders used a large financial institution's BMS as a persistent backdoor into the IT estate. No CVE, CVSS score, exploitation state or actor attribution is available for this item, so the assessment rests on the reporting alone. For EMEA financial services the exposure is direct: branch and data-centre BAS, badge and access-control platforms, and third-party facilities management all sit on the same flat networks as the systems that settle payments, and physical lockout or HVAC failure is a pressure lever that does not require data theft to work. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. ## 3\. Technical analysis & attack chain The French refrigeration incident is confirmed only at the level of outcome: thousands of remote-controlled refrigeration systems across hundreds of grocery stores were manipulated late on a Sunday night, temperatures rose, food spoiled and fires started. The initial access vector, exploited component, tooling and operator identity are not in the source material. The following chain is what the reporting supports as a general pattern across the cited incidents, not a reconstruction of any single intrusion. 1. Attackers reach internet-exposed building or refrigeration control endpoints. In the French case the units were remote-controlled and internet-connected; the reporting attributes the exposure to connectivity added for regulatory temperature and uptime monitoring rather than to any operational need. 2. They manipulate setpoints or control logic directly. No encryption or data theft is required for the effect: the refrigeration units were driven to temperatures that spoiled stock and, in some locations, started fires. 3. Where the objective is extortion rather than disruption, the physical effect is used as leverage. Semperis describes a case in which a customer refused payment and the operator locked staff out of the building; police had to break windows to regain entry. The customer did not pay. 4. Where the objective is persistent access, the BAS becomes a staging point. ServiceNow's Michael Freeman describes an intrusion at a very large financial institution in which attackers repeatedly lost their foothold in the IT environment, so they built backdoors into the BMS to retain access to both the OT and IT networks. The attackers stayed low and quiet in the BMS and pivoted from there into IT. 5. In the Canadian hospital case, ransomware disrupted building-management systems and took out door access controls, central HVAC monitoring and the issuing of staff access cards. The reporting does not state whether the BAS itself was encrypted or whether the disruption was a consequence of IT-side encryption. Technical specifics that matter to a defender, as far as the sources give them: - BAS scope. HVAC, lighting, energy usage, water consumption, badge readers, door locks, surveillance cameras and fire alarm control panels. These are the systems that determine whether staff can enter a building and whether a data hall stays within thermal limits. - Protocol exposure. Armis Labs reports that 91 percent of BAS communicate over insecure protocols. The reporting does not name which protocols. - Vulnerability prevalence. Armis Labs reports that 73 percent of organisations own BAS that have been used in ransomware attacks, and the same proportion have known exploited vulnerabilities in at least one of their building automation systems. The specific CVEs are not named. - Patching constraint. BAS and OT generally carry fewer security controls than IT, and most require continual uptime, which makes patching and even vulnerability scanning difficult because either can cause an outage. This is the reason the exposure persists rather than a knowledge gap. - Visibility gap. Dragos estimates fewer than 10 percent of OT networks worldwide have sufficient network monitoring. In 30 percent of incidents Dragos responded to in 2025, the investigation began because someone noticed something seemed wrong in operations, not because a detection alert fired. - Obscure platforms. Freeman reports attackers using AI to understand building automation systems running obscure operating systems, naming VxWorks and older Unix-type systems. The claim is that AI lowers the expertise barrier for interpreting proprietary protocols and control logic, including for safety-critical settings where operators historically avoided changes because the consequences were unknown. This is a forward-looking assessment from one vendor, not an observed capability in the French incident. - Scale trend. Dragos tracked 995 ransomware attacks against industrial organisations in 2023 (up 49.5 percent on 2022), a further rise of more than 87 percent in 2024, 119 ransomware groups affecting more than 3,300 industrial organisations in 2025, and 1,020 incidents in Q1 2026 rising to 1,140 in Q2 2026\. Dragos notes that leak-site claims are not always accurate and that a claim does not mean control systems were reached. Dragos also assesses the vast majority of cases as opportunistic rather than deliberately targeted at OT. Unconfirmed and single-sourced material. The French refrigeration incident has no named victim, no named actor and no technical detail beyond the outcome; treat any attribution as unconfirmed. The Armis Labs percentages, the Dragos incident counts and the AI-assisted control-system interpretation claim each rest on a single vendor's reporting and should be treated as directional rather than measured against your estate. The financial-institution BMS backdoor case is a single account from ServiceNow and is not corroborated elsewhere in the source material. No MITRE ATT&CK profile is available for any actor in this item, and no actor is named, so no attribution is offered. ## 4\. Mitigation & containment P1 (within 24 hours) - Inventory every internet-reachable BAS, BMS and refrigeration controller on the estate, including branch, data-centre and third-party-managed facilities. The French incident turned on remote reachability, so the first question for each device is whether it is reachable from the internet at all and whether that reachability is required for operations or only for reporting. - Where remote access exists only to satisfy monitoring or compliance reporting, move it behind the corporate VPN or a jump host with MFA and remove the direct internet path. The reporting is explicit that connectivity added for temperature and uptime evidence is the exposure. - Segment BAS and OT networks from the corporate IT estate. The financial-institution case shows a BMS backdoor being used to reach IT, so treat any BAS-to-IT path as a live route for an intruder who has already lost their IT foothold once. - Confirm that door access control, badge issuance and HVAC monitoring have a documented manual fallback. The Canadian hospital lost all three, and the Semperis case ended with police breaking windows to regain entry. P2 (within 72 hours) - Enable network monitoring on OT segments where it does not exist. Dragos puts global OT monitoring coverage below 10 percent and found that 30 percent of 2025 incidents were detected by operational staff noticing something wrong, which is not a detection capability. - Identify BAS running VxWorks or older Unix-type systems and record their patch level and vendor support status. These are the platforms the reporting singles out as hard to interpret and therefore hard to defend. - Review facilities-management and refrigeration-monitoring contracts for who holds patching responsibility and who holds remote access. Where a third party holds standing remote access to BAS, require it to be named, time-bound and logged. P3 (within 7 days) - Build a patching path for BAS that accounts for uptime requirements: vendor-approved maintenance windows, staged rollout, and a documented rollback. The reporting is clear that scanning and patching are avoided because they cause outages, so the control has to be scheduled rather than assumed. - Test the physical-consequence scenario. Walk through what happens to branch operations, cash handling and data-hall cooling if door access, badge issuance and HVAC control are simultaneously unavailable, and record the manual workarounds. - Add BAS and refrigeration controllers to the asset register with owner, network zone and remote-access status, so the next inventory is a query rather than a project. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The reporting names no hashes, domains, IP addresses, file paths, registry keys or command lines for any of the incidents described. Behavioural indicators | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | Setpoint or control-logic changes on refrigeration, HVAC or building controllers outside maintenance windows | BAS/BMS controller audit logs, building management console change history | Medium; pattern described in reporting, not tied to a named tool | | BAS or BMS reaching outbound to the corporate IT network, or IT systems initiating sessions to BAS management interfaces | Network flow data at the OT/IT boundary, firewall logs | Medium; single-sourced to the ServiceNow financial-institution account | | Persistent access mechanisms left in BMS after an IT-side eviction | BMS host process and service inventory, scheduled tasks on BMS servers | Medium; single-sourced to the ServiceNow account | | Door access, badge issuance or HVAC monitoring becoming unavailable at the same time as IT-side disruption | Physical security system logs, facilities helpdesk tickets | Medium; observed in the Canadian hospital incident | | Operational staff reporting unexplained physical behaviour (temperature drift, doors not responding) with no corresponding alert | Facilities and operations reporting channels | Medium; Dragos reports 30 percent of 2025 incidents began this way | ## 6\. Detection Insufficient indicators to author detection rules. The source material contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names, registry keys, ransom-note text or hard-coded values for any of the incidents described. The vendor names, percentages and incident counts in the reporting are not artefacts of the threat and would not produce a rule that matches malicious activity. ## 7\. Sources - The Register, "Cybercrims go beyond stealing data to attack physical building systems", https://www.theregister.com/security/2026/10/17/cybercrims-go-beyond-stealing-data-to-attack-physical-building-systems/5303677, published 2026-10-17\. Single source for this advisory; all vendor figures and case accounts are quoted within it. ## 8\. Adverse Trace position No CVE, CVSS score, EPSS value or CISA KEV entry is available for this item, and no actor is named, so we are not assigning a vulnerability severity. The operational severity is high for any client with internet-reachable BAS, because the French incident shows that physical disruption is achievable without encryption or data theft, and the financial-institution account shows a BMS being used as a durable route into IT after the intruders had been evicted from IT once. The reporting is single-sourced and the French incident in particular has no technical detail, so we treat the vendor percentages as directional and the AI-assisted control-system claim as an assessment rather than an observed capability. We will track for a named victim, actor or exploited CVE in the French refrigeration case, and for any vendor advisory covering the affected refrigeration or BAS platforms; clients who want the BAS and OT exposure mapped against their own estate should contact their Adverse Trace handler to scope an inventory and segmentation review. --- [Read the original source →](https://www.theregister.com/security/2026/10/17/cybercrims-go-beyond-stealing-data-to-attack-physical-building-systems/5303677?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*