When a Cyberattack Becomes a Building Emergency
A cyberattack does not have to start with an employee’s inbox. Sometimes, it starts with the equipment keeping a building running.
According to Ars Technica, attackers compromised refrigeration systems at an estimated 700 supermarkets in France, causing food spoilage and, in some cases, reported fires. The incident involved internet-connected controllers used to manage refrigeration equipment remotely.
For commercial property owners and managers, the story raises an uncomfortable question: What could happen if someone gained access to the systems operating your building?
When Cybersecurity Becomes a Building Operations Issue
Security researchers at Pen Test Partners pointed to exposed controllers, known security weaknesses, and outdated software as contributing problems.
Their analysis also highlighted a potential blind spot: equipment connected by a contractor through a separate internet connection that the business may not track or oversee.
That concern extends beyond supermarket refrigeration. Researchers identified the broader pattern as internet-accessible refrigeration or building controllers with insecure access.
They recommended restricting remote connections, updating equipment software, documenting third-party access, and separating networks appropriately.
For CRE, the takeaway is that protecting building technology belongs in the same conversation as maintenance, tenant service, and business continuity.
Consider the potential operational consequences if an unauthorized person could change HVAC schedules, interrupt access control, or interfere with connected equipment. Depending on the system and its safeguards, a disruption could affect tenant comfort, staff access, service delivery, or repair costs.
These are potential scenarios for building teams to evaluate.
Five Questions to Bring to Your Building Team
Property managers do not need to become cybersecurity experts to start a useful conversation. They can bring these questions to their engineers, IT teams, and service providers:
What is connected? Do we have a current inventory of connected building systems, including equipment installed by vendors?
Who has access? Which employees and contractors can connect remotely, and is access removed when their work ends?
Who handles updates? Is someone responsible for tracking security updates and equipment that is no longer supported?
How are systems separated? Could a problem with one device reach other building systems or tenant networks?
What happens during an outage? Can staff maintain essential operations and communicate with tenants if a connected system becomes unavailable?
The goal is to identify gaps before an equipment problem becomes a building-wide disruption.
Keep the Conversation Going November 17
These questions are part of a larger challenge: choosing and managing technology that improves building operations while accounting for the risks and responsibilities that come with it.
BOMA/GLA’s November 17 Property Technology educational program will bring together experts from Kilroy Realty, Genea, Montgomery Technologies, and 5x5 Telecom to discuss building operations, system integration, tenant experience, and cybersecurity.
Join us in DTLA from 8:30–10:00 a.m. Bring the technology questions your building team is working through and use the discussion to help inform your next steps.
