Analysis
Cybercriminals are increasingly attacking the physical systems that run buildings -- HVAC, lighting, door access, cameras and fire alarms -- rather than just stealing data, according to a report from The Register citing new research from security vendors Armis Labs, Dragos and Semperis. The shift matters because disrupting building operations can cause more immediate damage and give attackers more extortion leverage than data theft alone.
## How bad is the exposure right now? Armis Labs, now part of ServiceNow, found that 73% of organizations that own building automation systems (BAS) used in ransomware attacks have known exploited vulnerabilities in at least one system, and that 91% of BAS communicate over insecure protocols. Dragos data shows the broader trend: ransomware attacks on industrial organizations totaled 995 in 2023 and then grew more than 87% in 2024, with active threat groups climbing from 50 to 80 that year; in 2025, 119 groups hit more than 3,300 industrial organizations, and incident counts kept climbing through 2026, reaching 1,020 in Q1 and 1,140 in Q2 -- a single quarter that already exceeds all of 2023's annual total.
“- Canadian hospital (August 2026) -- a ransomware attack disrupted building-management systems, affecting door access, HVAC monitoring and staff access cards.”
- French grocery chains (October 2026) -- attackers hacked thousands of remote-controlled refrigeration units across hundreds of stores, raising temperatures, spoiling food and sparking fires.
- Canadian hospital (August 2026) -- a ransomware attack disrupted building-management systems, affecting door access, HVAC monitoring and staff access cards.
- Las Vegas casinos (December 2023) -- attacks stopped slot machines, disabled payment kiosks and ATMs, and locked guests out of their rooms.
- Unnamed Semperis client -- after refusing to pay, the attacker locked staff out of offices entirely, forcing police to break windows to regain access.
Two structural factors explain the acceleration. First, AI is lowering the expertise barrier: attackers can now use AI tools to learn obscure OT protocols and hardware quirks that used to require years of specialist knowledge, according to Matt Hayden, a former US DHS assistant secretary for cyber and infrastructure policy now at General Dynamics Information Technology. Second, compliance is creating exposure -- the French refrigeration units were connected to the internet specifically to prove regulatory compliance, which also opened a path for attackers exploiting unpatched firmware on devices that held no sensitive data themselves.
The counterweight is that OT security remains structurally hard to fix quickly: these systems need continuous uptime, making them difficult to patch or even scan without risking an outage, and Dragos found that in 30% of 2025 incidents, the organization only learned something was wrong because staff noticed, not because any detection system flagged it. That gap -- fewer than 10% of OT networks worldwide have sufficient monitoring, per Dragos -- is the market opportunity underpinning the current wave of OT-focused cybersecurity funding, and also the reason attacks keep outpacing defenses.