What happened
Late on a Sunday night, an unknown criminal group broke into thousands of remote-controlled refrigeration systems across hundreds of French grocery stores. Temperatures climbed, food spoiled, and fires started. The Register reported the incident alongside a wider pattern: in August, a ransomware attack disrupted building management systems at a Canadian hospital, knocking out door access controls, central HVAC monitoring, and the issuing of staff access cards. Three years ago, attacks on Las Vegas casinos left slot machines dark, payment kiosks and ATMs unable to dispense cash, and guests locked out of their rooms.
Building automation systems control HVAC, lighting, energy use, and water. They also run badge readers, door locks, surveillance cameras, and fire alarm panels. A report from ServiceNow's Armis Labs found that 73 percent of organizations own building systems that have been used in ransomware attacks, and the same share have known exploited vulnerabilities in at least one of those systems. Another 91 percent communicate over insecure protocols. Operational technology carries fewer controls than IT, and the need for continuous uptime makes patching and even scanning a risk in itself.
Consultants describe these systems as cover. Michael Freeman of ServiceNow said attackers find building management systems easier to compromise and easier to hide inside. In one case against a large financial institution, intruders kept losing their foothold in IT, so they built backdoors into the building management system to hold access to both networks at once.
Why this is a GRC story
Compliance connectivity created the exposure. Matt Hayden, now at GDIT and previously at DHS, described refrigeration monitoring as a regulatory requirement: operators connect the units so they can prove to health inspectors that temperatures held. The same link that produces the evidence is a path in. A control designed to demonstrate compliance added a device to the estate that nobody treats as a server, and that often runs unpatched firmware.
Scope is the second problem. Most risk registers list applications, data stores, and cloud tenants. Fewer list the fridge, the badge reader, or the fire panel. An asset that is out of scope is not assessed, not patched on a schedule, and not in the incident response runbook. Dragos estimates fewer than 10 percent of OT networks have adequate monitoring, and in 30 percent of the incidents it responded to in 2025 the investigation began because an operator noticed something felt wrong, not because an alert fired.
The extortion model changed too. Physical consequences create pressure that stolen records do not. A response plan built around data theft and notification duties does not cover a site that has to be entered through a broken window.
What to watch
Dragos counted 1,020 ransomware incidents against industrial organizations in the first quarter of 2026 and 1,140 in the second, though those are leak site claims rather than confirmed control system hits. Watch whether insurers and auditors start asking for a building system inventory, and whether the French incident produces a regulator response on device connectivity. The practical step is small: add building and physical safety systems to the asset inventory, name an owner, and find out what they talk to.
Attribution: Analysis based on The Register and related public reporting. This article is original commentary, not a repost of the source material.