Ransomware Crews Are Done With Your Data. Now They Want Your Building

Late on a Sunday night, someone hacked thousands of remotely operated refrigeration units across hundreds of French supermarkets. Temperatures spiked. Food spoiled. Fires broke out. Nobody has claimed responsibility yet, but the incident fits a pattern that security researchers have been flagging for a while: attackers are increasingly going after physical systems rather than just hoovering up data.

In August, a ransomware group hit building management systems at a Canadian hospital, knocking out HVAC monitoring, door access controls, and staff card issuance. A few years before that, Las Vegas casinos took hits that darkened slot machines, killed ATMs, and left guests locked out of their rooms when the electronic key systems died.

This is not a niche problem. It is becoming a preferred tactic.

"There was one gig where the customer was refusing to pay, and so the threat actor was like, 'Hold my beer, have fun getting into your offices,' and locked everybody out," said Tim Beasley, a senior incident response consultant at Semperis. The resolution involved police breaking windows to let staff back into their own building. Did the victim pay the ransom? Beasley's response was unprintable, but the gist was no.

Building automation systems, or BAS, sit at the intersection of IT and operational technology. They run HVAC, lighting, water systems, badge readers, door locks, fire alarms and surveillance cameras. That makes them enormously useful to anyone wanting to apply physical pressure during an extortion attempt. Encrypting a file server is annoying. Locking everyone out of the building at 2am is something else entirely.

Armis Labs, part of ServiceNow, published research this month showing 73 percent of organisations own BAS that have already been used in ransomware attacks. The same percentage have known exploited vulnerabilities sitting in at least one of their building automation systems. Ninety-one percent of BAS communicate over insecure protocols. These are not numbers that suggest the situation is under control.

Michael Freeman, ServiceNow's senior director of threat research, told us that BAS are popular with attackers for a fairly straightforward reason: they are easy to get into and easy to hide in. "It's easier for them to compromise, and it's easier for them to hide in," he said. OT environments tend to have fewer security controls than IT networks, and because these systems need to run continuously, patching them or even scanning for vulnerabilities is genuinely risky. Downtime is not an option when the system in question controls access to a hospital ward.

In one case Freeman described, attackers targeting a large financial institution kept getting caught and ejected from the IT network. Their solution was to build backdoors into the building management systems instead, using OT as a persistent foothold to pivot back into IT whenever they needed to.

AI is making all of this considerably worse. OT systems have historically been protected in part by their own obscurity. Proprietary hardware, unusual operating systems, arcane protocols. Knowing how to actually manipulate a VxWorks-based industrial controller used to require years of specialist knowledge. That barrier is collapsing. Attackers can now use AI to understand systems they would never have been able to operate manually.

Freeman gave a pointed example. Historically, even sophisticated nation-state groups would tread carefully around unfamiliar OT gear because they had no idea what changing a setting might actually do. Now, he said, an attacker could ask an AI to explain the consequences of altering a weight and balance system on an aircraft, and get a usable answer. He has personally helped remove intruders from airline OT systems in the past. Those attackers left without causing harm, largely because they did not understand what they had access to. That excuse is disappearing.

Dragos, which tracks ransomware activity against industrial organisations, has seen the numbers go in one direction for several years. The firm recorded 995 attacks against industrial organisations in 2023, up roughly 50 percent from the year before. 2024 saw another jump of more than 87 percent. By 2025, Dragos was tracking 119 distinct ransomware groups affecting over 3,300 industrial organisations, with incidents continuing to climb each quarter into 2026.

Most of these attacks are opportunistic, according to Dragos senior threat analyst Abdul Alamri. Ransomware operators generally do not want to spend months reverse-engineering complex OT environments. They want to encrypt something important and get paid. When OT systems do get hit, it is often a side effect rather than a deliberate choice. The Jaguar Land Rover breach in August 2025 is a good example: attackers went through IT systems and still managed to halt manufacturing and cripple operations for months.

The deeper problem is that most organisations have almost no visibility into what is happening in their OT environments. Dragos estimates fewer than 10 percent of OT networks globally have adequate monitoring. In 30 percent of the incidents the firm responded to in 2025, the investigation did not start with a detection alert. It started with someone noticing that something felt wrong.

Matt Hayden, VP of cyber and emerging threats at General Dynamics Information Technology and a former DHS assistant secretary, made a point worth sitting with. Many devices are now internet-connected not because anyone thought carefully about security, but because regulations require it. Refrigeration units, for instance, need to report temperature and uptime data to demonstrate regulatory compliance. That connectivity is also an attack surface.

"So if the health department comes by, they say, 'Look, my refrigerator was at 27 degrees for the last 72 days,' and they have a check mark, and they get their A plus," Hayden told us. "But that simple connectivity is also a vector in which that particular refrigerant unit could be targeted for disruption."

He said that roughly a week after that conversation, the French supermarket attacks happened.

Hayden expects whoever carried out that attack to turn out to be opportunists scanning for unpatched firmware rather than any nation-state operation. The consequences this time were localised. Spoiled food, some fires, significant costs. But the same approach applied to more consequential infrastructure would not stay localised.

As organisations get better at securing IT environments, the calculation for attackers shifts. OT systems connected to the internet, often under-monitored, rarely patched, and capable of causing real physical harm, are the obvious next target. Security through obscurity bought the sector time it mostly did not use.