Hackers are exploiting building systems to disrupt services and extort organisations

Cybercriminals are increasingly targeting building and other physical systems, using digital attacks to disrupt access, damage property and put pressure on organisations to pay. Recent incidents include refrigeration systems in French grocery stores being compromised, a ransomware attack affecting a Canadian hospital’s building controls, and earlier attacks that disrupted services at Las Vegas casinos.

Building automation systems control equipment such as heating, ventilation, lighting, doors, cameras and fire alarms, but often have weaker security and are difficult to patch without interrupting service. A ServiceNow Armis Labs report found that 73 per cent of organisations have building systems used in ransomware attacks and the same share have known exploited vulnerabilities; 91 per cent use insecure communications protocols. Researchers also described attackers hiding in building systems and using them to regain access to corporate networks.