Cybercriminals Pivot to Physical Infrastructure Attacks
Hackers are increasingly targeting building automation systems to create real-world operational chaos.
1Escalation to Physical Sabotage
Cybercriminals are moving beyond data theft to disrupt physical building systems. Recent incidents include hacked refrigeration units in French grocery stores, compromised HVAC controls at a Canadian hospital, and locked doors in Las Vegas casinos. These attacks demonstrate that digital intrusions can now trigger immediate, damaging consequences in the physical world.
2Building Automation as Leverage
Building automation systems (BAS) manage critical infrastructure like lighting, fire alarms, and door locks. Because these systems operate at the intersection of IT and OT, they provide attackers with high-pressure leverage. Armis Labs reports that 73 percent of organizations use BAS that have been targeted in previous ransomware campaigns.
3Security Gaps in OT
Most BAS communicate over insecure protocols, creating a massive attack surface. Unlike standard IT environments, these systems often require continuous uptime, making them difficult to patch or scan for vulnerabilities. Attackers frequently use these systems as persistent backdoors, pivoting from the BAS into the broader corporate IT network undetected.
4AI-Driven Threat Evolution
Artificial intelligence is lowering the barrier for entry into industrial cyberattacks. Criminals now use AI to analyze obscure operating systems and proprietary hardware protocols that were previously considered black boxes. This capability allows attackers to manipulate complex machinery, such as aircraft weight systems, without needing deep, specialized industrial engineering expertise.
5Rising Industrial Ransomware Trends
Dragos data shows a steady increase in ransomware attacks against industrial organizations since 2022. The number of incidents rose from 995 in 2023 to significantly higher levels in 2026, with 1,140 incidents recorded in Q2 alone. The number of active ransomware groups targeting these industrial sectors grew to 80 by 2024.
6Opportunistic Nature of Attacks
Most industrial cyberattacks remain opportunistic rather than highly targeted. Ransomware groups prioritize speed and ease, often opting to disrupt IT systems to halt manufacturing, as seen in the 2025 Jaguar Land Rover breach. These groups seek to force ransom payments by creating operational paralysis rather than investing in complex, long-term exploits.
7Visibility and Monitoring Deficits
Many organizations lack sufficient visibility into their operational technology environments. Dragos estimates that fewer than 10 percent of global OT networks have adequate monitoring in place. In 30 percent of investigated incidents, detection occurred only after staff noticed physical anomalies, rather than through automated security alerts or proactive threat hunting.
8Compliance-Driven Connectivity Risks
Regulatory compliance mandates are inadvertently increasing cyber risk. Organizations connect refrigeration units and other hardware to the internet to prove temperature uptime to regulators. This simple connectivity creates an unpatched entry point for attackers. These devices, while lacking sensitive data, serve as high-impact targets for causing physical supply chain degradation.
9Future of Infrastructure Security
As IT security improves, attackers will likely shift focus toward internet-connected OT systems. The transition from human-led attacks to potential AI-agent exploitation suggests a challenging future for infrastructure protection. Organizations must prioritize securing these physical systems to prevent small-scale disruptions from evolving into catastrophic, large-scale failures of critical facility operations.