Attackers Hijack Building Controls to Lock Out Staff and Spoil Food
Cybercriminals are targeting physical infrastructure to force ransom payments, locking employees out of offices and disrupting HVAC systems in hospitals.
Key points
- French grocery stores suffered food spoilage and fires after hackers manipulated remote refrigeration controls.
- A Canadian hospital faced disrupted door access and HVAC monitoring during a ransomware incident.
- Semperis consultant Tim Beasley described an incident where attackers locked staff out of an office.
Cybercriminal groups are increasingly targeting physical building management systems to create real-world chaos and pressure victims into paying ransom demands. This escalation moves beyond traditional data theft or file encryption, leveraging control over doors, temperature, and safety systems to inflict tangible damage on organizations.
Recent incidents highlight the severity of this trend. Late Sunday night, unknown attackers compromised thousands of remote-controlled refrigeration units across hundreds of French grocery stores. The intrusion caused temperatures to spike, resulting in spoiled food and sparking fires within the affected retail locations.
Context and Background
The attack on French retailers is part of a broader pattern of intrusions into operational technology (OT) and building automation systems (BAS). In August, a ransomware campaign disrupted a Canadian hospital’s infrastructure. The attack affected central HVAC monitoring, door access controls, and the issuance of staff access cards, complicating physical security and environmental management.
Historical precedents also demonstrate the potential for physical disruption. Three years ago, cyberattacks targeted Las Vegas casinos, causing slot machines to go dark and preventing ATMs and payment kiosks from dispensing cash. Guests were locked out of their rooms because electronic keys ceased to function, illustrating how digital intrusions can paralyze physical operations.
Who Is Affected
Industry experts note that attackers use these physical consequences as leverage. Tim Beasley, a senior incident response consultant at Semperis, told The Register about an incident where a customer refused to pay a ransom. The threat actor responded by locking the staff out of their offices, forcing police to break windows to allow entry.
Beasley confirmed that the customer did not pay the extortion demand. The incident response team recovered compromised data, but the physical breach required law enforcement intervention to restore access. This approach turns up the heat on executives by creating immediate safety and operational hazards.
A report from ServiceNow’s Armis Labs, published earlier this month, states that modern BAS operate at the intersection of IT and OT worlds. This convergence creates unprecedented exposure for organizations, allowing attackers to bridge the gap between digital networks and physical building controls.
What should you do?
Security professionals should assess the connectivity between their IT networks and building automation systems. Isolating critical infrastructure from general corporate networks can reduce the attack surface. Organizations should also review access controls for physical security systems to ensure they are monitored and protected against unauthorized changes.
What to do and how to stay safe: Semperis
- Audit the network segmentation between IT systems and building automation or operational technology networks.
- Monitor for unusual activity in HVAC, refrigeration, and access control systems that could indicate manipulation.
- Ensure physical security protocols include manual overrides for doors and safety systems in case of digital failure.
- Review vendor security practices for any third-party systems that manage critical building functions remotely.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the French grocery stores pay the ransom?
The source material does not state whether the French grocery stores paid a ransom, only that the attackers manipulated refrigeration systems.
What happened at the Canadian hospital?
A ransomware attack disrupted door access controls, central HVAC monitoring, and the issuing of staff access cards at the hospital.
Did the customer in the office lockout incident pay?
No, Tim Beasley from Semperis confirmed that the customer who was locked out of their office did not pay the ransom demand.
