Attackers increasingly target building automation and OT systems; French grocery refrigeration hack causes spoilage and fires
A still-unknown actor hacked thousands of remote-controlled refrigeration systems across hundreds of French grocery stores, spiking temperatures, spoiling food and sparking fires. The incident fits a broader trend of extortionists and other attackers going after physical systems to maximise real-world pressure on victims. Earlier examples include an August ransomware attack on a Canadian hospital's building-management systems and the 2023 Las Vegas casino attacks. A new Armis Labs (ServiceNow) report and Dragos data show building automation systems (BAS) and industrial organizations are under growing ransomware pressure, with limited OT visibility and weak security controls.
Technical Details
- Armis Labs found 73% of organizations own BAS that have been used in ransomware attacks, and the same share have known exploited vulnerabilities in at least one BAS. 91% of BAS communicate over insecure protocols.
- ServiceNow described a case against a large financial institution where actors hid in BMS systems and pivoted into the IT environment. After being repeatedly evicted from IT, they built backdoors into the BMS to keep persistent access to both OT and IT networks.
- Threat actors are reportedly using AI to learn obscure OT platforms (e.g., VxWorks, older Unix-type systems) and proprietary protocols, lowering the expertise barrier for destructive attacks.
- Dragos tracked 995 ransomware attacks on industrial organizations in 2023 (+49.5% over 2022), more than 87% growth in 2024, and 119 groups affecting more than 3,300 industrial organizations in 2025. It counted 1,020 incidents in Q1 2026 and 1,140 in Q2 2026. Leak-site claims are not always accurate and do not necessarily mean OT was hit. Most impacts are opportunistic.
- Dragos estimates fewer than 10% of OT networks have sufficient monitoring, and in 30% of its 2025 incident responses the investigation began because someone noticed something wrong in operations rather than from an alert.
- GDIT's Matt Hayden attributed the French refrigeration incident to exploitation of internet-connected units running unpatched firmware, and expects opportunistic actors rather than a nation-state. The article does not name the specific vulnerability or vendor.
- A Semperis responder described an extortion case where the actor locked staff out of a building's access systems, and police had to break windows to regain entry.
Remediation
- Improve OT and BAS network monitoring and visibility.
- Patch firmware on internet-connected OT devices where feasible, and avoid exposing them to the internet unnecessarily, including compliance-driven remote monitoring.
- Segment BMS and OT networks from IT, since BMS can serve as a hidden pivot and persistence point.
- Replace or restrict insecure protocols used by BAS.
Linha do tempo
-
Attackers increasingly target building automation and OT systems; French grocery refrigeration hack causes spoilage and fires
ler a análise desta fonte ocultar
A still-unknown actor hacked thousands of remote-controlled refrigeration systems across hundreds of French grocery stores, spiking temperatures, spoiling food and sparking fires. The incident fits a broader trend of extortionists and other attackers going after physical systems to maximise real-world pressure on victims. Earlier examples include an August ransomware attack on a Canadian hospital's building-management systems and the 2023 Las Vegas casino attacks. A new Armis Labs (ServiceNow) report and Dragos data show building automation systems (BAS) and industrial organizations are under growing ransomware pressure, with limited OT visibility and weak security controls.
Technical Details
- Armis Labs found 73% of organizations own BAS that have been used in ransomware attacks, and the same share have known exploited vulnerabilities in at least one BAS. 91% of BAS communicate over insecure protocols.
- ServiceNow described a case against a large financial institution where actors hid in BMS systems and pivoted into the IT environment. After being repeatedly evicted from IT, they built backdoors into the BMS to keep persistent access to both OT and IT networks.
- Threat actors are reportedly using AI to learn obscure OT platforms (e.g., VxWorks, older Unix-type systems) and proprietary protocols, lowering the expertise barrier for destructive attacks.
- Dragos tracked 995 ransomware attacks on industrial organizations in 2023 (+49.5% over 2022), more than 87% growth in 2024, and 119 groups affecting more than 3,300 industrial organizations in 2025. It counted 1,020 incidents in Q1 2026 and 1,140 in Q2 2026. Leak-site claims are not always accurate and do not necessarily mean OT was hit. Most impacts are opportunistic.
- Dragos estimates fewer than 10% of OT networks have sufficient monitoring, and in 30% of its 2025 incident responses the investigation began because someone noticed something wrong in operations rather than from an alert.
- GDIT's Matt Hayden attributed the French refrigeration incident to exploitation of internet-connected units running unpatched firmware, and expects opportunistic actors rather than a nation-state. The article does not name the specific vulnerability or vendor.
- A Semperis responder described an extortion case where the actor locked staff out of a building's access systems, and police had to break windows to regain entry.
Remediation
- Improve OT and BAS network monitoring and visibility.
- Patch firmware on internet-connected OT devices where feasible, and avoid exposing them to the internet unnecessarily, including compliance-driven remote monitoring.
- Segment BMS and OT networks from IT, since BMS can serve as a hidden pivot and persistence point.
- Replace or restrict insecure protocols used by BAS.