When Ransomware Locks the Doors: Why Building Systems Are the New Cyber Frontier

Ransomware has always been about leverage, and attackers are finding new kinds. A report published this month by ServiceNow’s Armis Labs found that 73% of organisations own building automation systems (BAS) that have been used in ransomware attacks, that the same proportion have known exploited vulnerabilities in at least one of those systems, and that 91% of building automation systems communicate over insecure protocols. These are the systems that run door access, heating and ventilation, lighting and fire alarms — and the incidents behind the numbers are no longer theoretical. In October 2026, an attack hacked thousands of remote–controlled refrigeration systems across hundreds of French grocery stores, spiking temperatures, spoiling food and sparking fires. In August 2026, a ransomware attack disrupted building–management systems at a Canadian hospital, affecting door access, central HVAC monitoring and the issuing of staff access cards.

The shift is from stealing data to causing physical disruption, and it changes what an incident feels like. Tim Beasley, a senior incident response consultant at Semperis, described a case in which a customer refused to pay a ransom and the attacker responded by locking every door in the building; police had to break windows to let staff back in. The customer still refused to pay. For most UK businesses, building systems sit in an awkward place: installed by a facilities contractor or the landlord, connected to the network for convenience, and absent from any IT asset list. ServiceNow’s Michael Freeman explained why attackers like them: they have fewer security controls than IT systems and require continual uptime, which makes them harder to patch or scan without risking an outage. That combination makes them, in his words, “a great place for the threat actor to hide”.

What the research and the incidents show

Building automation systems are the controllers and software that run a building’s physical functions: who can open which doors, how heating, ventilation and air conditioning respond, when lights come on, how fire alarms signal, and increasingly refrigeration, lifts and energy management. They were traditionally designed to be reliable and always on rather than secure, and many were never expected to be connected to anything else. As buildings became “smart” and remote management became normal, those systems were joined to office networks and the internet — often without the security controls that IT systems take for granted.

The Armis Labs findings describe the scale of the resulting exposure. Seventy–three per cent of organisations own building automation systems that have been used in ransomware attacks; seventy–three per cent have known exploited vulnerabilities in at least one of their building automation systems; and ninety–one per cent of these systems communicate over insecure protocols. The last figure is the most structural. Protocols designed for closed, trusted environments typically lack authentication or encryption, which means that anyone able to reach the network they run on may be able to read or send commands.

The incidents show what that exposure becomes. The French grocery attack in October 2026 targeted remote–controlled refrigeration across hundreds of stores; temperatures spiked, food spoiled and fires broke out. The Canadian hospital incident in August 2026 disrupted building–management systems, affecting door access controls, central HVAC monitoring and the issuing of staff access cards — a reminder that building systems are part of how an organisation functions day to day, not a background utility. Beasley’s locked–doors case shows how attackers can convert that dependency into pressure.

Freeman’s account adds a further dimension: building systems as a hiding place. He described a case at a large financial institution where attackers were repeatedly ejected from IT systems, but had built persistent backdoors into the building management system that let them maintain access to both operational technology and IT networks. The defenders were cleaning the IT estate while the attackers kept coming back through the building.

And the barrier to entry is falling. Freeman said attackers are increasingly using AI to understand the obscure operating systems used in building automation, such as VxWorks and older Unix variants. Systems that were once too unfamiliar or too risky for attackers to manipulate are becoming easier to understand and control — which removes one of the few accidental protections these systems used to have.

How building systems became a target

The chronology below combines the dated incidents in the reporting with the background that explains them. Where an incident is described without a date, the entry says so.

The pattern across those entries is that building systems have moved from an obscure corner of IT to a deliberate target. Each step made them more reachable — network connection, remote management, insecure protocols — and the last step, AI assistance in understanding unfamiliar operating systems, removes one of the reasons attackers used to leave them alone. For defenders, the window in which obscurity offered some protection is closing.

Which building systems carry the most risk

The chart below is an indicative planning model — not measured data — weighting common building systems in a UK SME or multi–tenant office by a combination of how often they are network–connected without proper separation and how serious the consequences of compromise would be.

Door access sits at the top because it combines high consequence with frequent exposure. It is the system that decides whether staff can get into the building, and it often runs on controllers and software installed by a security contractor, connected to the office network for card management and reporting. The Canadian hospital incident and Beasley’s locked–doors case both show what its failure looks like in practice.

Refrigeration sits in the middle of the chart for a typical office, but for a food retailer, restaurant, pharmacy or laboratory it would be near the top. The French grocery attack shows why: remotely managed refrigeration is a direct route from a network compromise to spoiled stock, and in that case to fires. The right ranking for any business depends on what it actually runs, which is why the starting point is a list of every building system and what would happen if it stopped.

Ninety–one per cent talk over insecure protocols

Of the three Armis Labs figures, this is the one that explains the others.

Many building automation protocols were designed for closed, trusted environments where every device on the wire was assumed to be legitimate. They frequently lack authentication or encryption, so a device on the same network can often read commands, send them, or impersonate a controller. That was a reasonable design decision for an isolated plant room. It becomes a serious weakness once those systems share a network with staff laptops, guest Wi–Fi or internet–facing equipment.

The practical consequence is that the protocol itself is rarely the thing a small business can fix — replacing building controllers is expensive and usually a landlord’s or facilities contractor’s decision. What a business can influence is who can reach those protocols. If the building systems sit on their own separated network segment, with only the specific connections they need, then a compromised laptop or a phishing victim does not automatically have a path to the door controllers. Segmentation is the control that compensates for protocols that cannot defend themselves.

This also explains Freeman’s point about hiding places. Because these systems are hard to patch, rarely monitored and often run on obscure operating systems, an attacker who reaches them can establish persistence that IT–focused defenders do not see. In the financial institution case he described, that persistence outlived repeated clean–ups of the IT estate. A business that segments its building systems and includes them in monitoring closes that gap; one that treats them as someone else’s problem leaves it open.

Where UK businesses are exposed

The rows below reflect where building–system risk typically sits for a UK SME, whether in its own premises or as a tenant in a managed building, with badges indicating how much attention each usually needs.

The third row is one of the most common routes in. HVAC, access control and building management vendors often support their systems remotely, and the convenient way to do that is a permanent remote–access connection. Those connections are frequently set up once and left in place indefinitely, with shared credentials and no record of who uses them. They are a direct path from the internet to the building systems, bypassing much of the organisation’s own security. Replacing standing access with connections that are enabled only when needed, logged and tied to named individuals removes one of the easiest routes for an attacker.

The seventh row matters especially in multi–tenant buildings. A tenant may have no control over the building management system but still depend on it for access and heating, and may even share a network segment with it. Asking the landlord or managing agent who maintains the building systems, how they are separated from tenant networks, and what happens to access control during an outage is a reasonable request — and the answers belong in the tenant’s own continuity planning.

What getting building systems under control costs

The bands below are indicative planning figures for UK businesses assessing and securing their building systems — not quotes. Replacing controllers or building management systems is a separate and usually larger cost.

The second row covers most businesses in their own premises, and segmentation is the item that does the most. It does not require replacing any building system; it changes who can reach them. Combined with removing standing contractor access and changing default passwords, it addresses the main ways attackers get from an office network into the building’s physical controls.

Two ways to treat the building’s systems

The deciding difference between those columns is ownership. On the left, building systems belong to nobody in IT and nobody in security; they belong to the contractor who installed them, who may not think about cyber threats at all. On the right, they are treated as part of the organisation’s attack surface, because they are. That does not mean IT has to run the HVAC. It means somebody makes sure the building’s systems are separated, accessed properly, maintained and included when the organisation plans for an incident.

Why this matters for UK businesses specifically

Several things make this trend relevant to UK organisations right now. The first is the move of building systems onto IP networks. The retirement of the analogue phone network has pushed alarm signalling, door entry and lift communication onto broadband connections, often onto the same network as everything else. That migration is necessary, but each system moved onto the office network without separation joins the attack surface Armis Labs describes.

The second is the prevalence of shared and managed buildings. Many UK SMEs are tenants in multi–occupancy offices, retail parades or business parks, where building systems are owned and managed by a landlord or facilities company. Those tenants depend on the systems for access and comfort but have little visibility of how they are secured. The French grocery and Canadian hospital incidents show that the impact lands on the occupier, whoever owns the controller.

The third is the trend toward physical leverage. Beasley’s case is instructive precisely because the customer still refused to pay. Locking the doors did not change their decision, but it did disrupt the business and required police to intervene. Attackers who cannot extort payment through stolen data alone are looking for other kinds of pressure, and physical disruption is one. Preparing for that — a plan for operating without door access, heating or refrigeration for a period — is part of resilience in the same way that backups are.

For organisations pursuing Cyber Essentials, building systems raise a scoping question worth raising explicitly with an assessor. Network–connected controllers, cameras and alarm panels are devices; if they sit on the same network as in–scope systems, they affect the boundary and the secure configuration of that network. Default passwords, unsupported firmware and unrestricted remote access are exactly the issues the scheme’s controls are designed to address. Separating building systems onto their own segment, out of scope, is often the cleanest answer — and it is also the most effective security measure.

The story at a glance

This story connects to several we have covered recently. The AI minister’s warning that a breach is “likely, if not inevitable” makes the assume–breach case that applies here: plan for building systems being affected, not only for keeping attackers out. The Met Police shadow IT reprimand describes systems that escape governance because they arrive through a side door — much as building systems arrive through facilities contracts. The latest UK retail cyber–attacks show the sector pressure that the French grocery attack takes into the physical world. The PSTN switch–off explains why alarm, door entry and lift systems are moving onto IP networks. The NCSC advisory on Integrity Tech describes how ordinary connected devices are absorbed into attackers’ infrastructure. And the Cisco email gateway zero–day is a reminder that systems running continuously are often the hardest to patch, and the most attractive to attackers.

Frequently asked questions

Cloudswitched

London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.