Last Sunday night, someone hacked thousands of remote-controlled refrigeration systems across hundreds of French grocery stores. Temperatures spiked, food spoiled and some units caught fire. A Register report published this week puts that attack in a wider pattern: criminals are moving past data theft to hit the physical systems that run buildings, and AI is lowering the skill needed to do it.
Locked out of your own office
Tim Beasley, an incident responder at Semperis, described one case where a customer refused to pay and the attacker simply locked everyone out of the building. Police had to break windows to get staff back inside. The customer did not pay.
In August a ransomware attack at a Canadian hospital disrupted its building-management systems, including door access controls, central HVAC monitoring and staff access cards.
Why building systems are an easy target
Building automation systems (BAS) control HVAC, lighting, energy and water, and also badge readers, door locks, cameras and fire alarm panels. A report this month from ServiceNow's Armis Labs found:
- 73% of organisations own BAS that have been used in ransomware attacks
- 73% have known exploited vulnerabilities in at least one building system
- 91% of BAS communicate over insecure protocols
These systems need continuous uptime, so they are hard to patch or even scan. Michael Freeman, ServiceNow's senior director of threat research, said that makes them good places for attackers to hide. In one case at a large financial institution, intruders kept getting thrown out of the IT network, so they built backdoors into the building-management system to keep their access.
Where AI comes in
Freeman said attackers are using AI to understand building systems running obscure operating systems such as VxWorks and older Unix variants. That knowledge used to be a real barrier. Even well-funded state groups would tread carefully inside OT gear because they did not know what changing a setting would do. With AI explaining the protocols and the equipment, that hesitation goes away.
Abdul Alamri, a senior threat analyst at Dragos, put it bluntly: compared with human attackers, AI agents that keep trying to break into these systems point to "a pretty dark future" unless defences improve.
The numbers behind the trend
Dragos tracked 119 ransomware groups hitting more than 3,300 industrial organisations in 2025. This year the count has risen every quarter, with 1,020 incidents in Q1 2026 and 1,140 in Q2. Meanwhile Dragos estimates fewer than 10% of OT networks worldwide have adequate network monitoring, and in 30% of the incidents it handled in 2025 the investigation started because someone noticed "something seemed wrong" in operations, not because an alert fired.
Connected for compliance, exposed by default
Matt Hayden of General Dynamics IT warned, before the French attack, that devices like refrigeration units are now online mainly so operators can prove temperatures to regulators. That connection is also a way in. A week after he said it, criminals proved him right. His view is that this was opportunism against unpatched firmware, and a small preview of what could happen with more consequential equipment.
What I would do with this
For anyone running offices, plants, hospitals or campuses, the building network belongs in the security programme, not just with facilities. Inventory every connected BAS and OT device, take off the internet anything that only needs to be online for reporting, segment what remains from IT, and put monitoring on it. AI makes attackers faster at learning obscure systems, so obscurity can no longer be counted on as protection.
Source: Cybercrims go beyond stealing data to attack physical building systems, The Register
