Criminals are no longer content to encrypt files and steal records. A growing share of intrusions now reach into the machinery that runs buildings, and the pressure that creates on executives is the point.
The Register spoke with incident responders who describe ransom negotiations where the leverage was physical. Tim Beasley of Semperis recalled a customer who refused to pay, after which the intruders locked every badge reader in the building. Police ended up breaking windows so staff could get back inside.
That case sits in a wider pattern. In August a ransomware crew disrupted building management at a Canadian hospital, taking out door access, central HVAC monitoring and staff card issuance. And a recent ServiceNow Armis Labs report found mounting evidence that attackers now treat real-world disruption as a bargaining chip.
What building systems actually control
Building automation covers heating, lighting, energy and water use, plus badge readers, door locks, cameras and fire panels. In France this month, attackers hit thousands of remote-controlled refrigeration units across hundreds of grocery stores, spiking temperatures, spoiling stock and starting fires. The site has covered that campaign separately.
Most of these controllers were never designed to face the internet. Facilities teams should inventory every BAS endpoint reachable from outside, segment it from corporate networks, and rehearse what happens when doors stop opening. Paying is not the only bad outcome; the inability to operate the building is worse.
