Hacker Peril!: Cybersecurity Is Becoming a Critical Concern for Facility Management
Industry Highlights Series
Tim Ballard | ConnexFM
"Never trust a computer you can't throw out a window."
This was a quote attributed to Steve Wozniak, vocal cybersecurity advocate and the man who co-founded Apple Computer Company way back in 1976, along with Steve Jobs and Ronald Wayne. This wasn't a quote from the beautiful, boxy 1980s, either, where even portable "luggables" were like carrying a suitcase. This was a quote from around 2009, during the early days of smartphones and the advent of smarter technology.
The golden age of digital advancements is upon us, and each decade, digitally advanced technologies that were once thought to be the realm of science fiction in the late 1990s have begun appearing, layer by layer, at a rapid... and dangerous pace.
Damage Report
In 2025, the FBI received more than 1 million reported cybercrime complaints in the United States, resulting in more than $20.8 billion in reported losses. Among those complaints, more than 3,200 involved ransomware and data breaches targeting critical infrastructure organizations. Meanwhile, European facilities have faced an increasingly concerning wave of cyber threats. Most recently, hackers targeted refrigeration control systems at hundreds of supermarkets in France before similar attacks spread to other European countries, demonstrating how vulnerable even your everyday building systems can become when connected to the internet.
The really scary part is that almost any connected system can be infiltrated if it has some connection to the outside world, whether through a malicious download, a faulty digital installation, or even plugging a USB dongle into a system that contains malware. All it takes is someone with good skills and bad intentions to create an expensive and potentially hazardous situation.
Your Weak Spots
Remember in Jurassic Park when the entire system was shut down by Wayne Knight's character, allowing dinosaurs to run around terrorizing Sam Neill and Laura Dern and helping produce one of the greatest blockbusters of 1993? Dennis Nedry's actions were deliberate sabotage rather than a conventional cyberattack, but the incident is still a perfect example of how one person with access to critical digital facility systems can bring an entire operation to its knees.
While you hopefully won't have dinosaurs running around your facility terrorizing your staff if a cyberattack slips through, you could be facing costly operational disruptions or, worse, the exposure of sensitive information regarding proprietary systems and employee details. This is why the most important first step is to identify which aspects of facility management are most likely to be targeted.
Your vulnerabilities could be any one of these:
Building Operations: HVAC, Automation, and Refrigeration
What's Included: Heating, ventilation, and air conditioning (HVAC) equipment, building automation systems, and refrigeration controls.
What It Does: These systems regulate heating, cooling, ventilation, and other environmental conditions throughout a facility. Building automation systems can also coordinate multiple building functions through connected controllers and monitoring platforms.
How It's Vulnerable: Network-connected controllers, remote monitoring platforms, outdated software, weak passwords, and poorly managed vendor access can create openings for attackers to interfere with building operations. The National Institute of Standards and Technology (NIST) identifies building automation systems as operational technology that requires specialized cybersecurity protections.
Physical Security: Access Control and Surveillance
What's included: Electronic locks, badge readers, security gates, alarm systems, and surveillance cameras.
What It Does: These systems regulate who can enter a facility, monitor activity, and help security personnel identify unauthorized access.
How It's Vulnerable: Many rely on network-connected controllers, servers, and remote management software. Compromised credentials, unsecured devices, or poorly protected network connections could allow attackers to manipulate access permissions, interfere with monitoring, or gain access to sensitive footage. The U.S. Government Accountability Office (GAO) has warned that increased connectivity in federal buildings and commercial facility access control systems creates opportunities for cyberattacks.
Life Safety: Fire Alarms and Emergency Systems
What's included: Fire alarms, sprinkler monitoring, smoke controls, and other connected life-safety equipment.
What It Does: These systems detect potential emergencies, alert building occupants and responders, and help control hazards such as fire and smoke.
How It's Vulnerable: Network connections, system servers, remote maintenance access, and physical connection points can expose these systems to attack. Research from the NFPA Research Foundation identifies network interfaces and external access points as potential vulnerabilities in connected fire protection systems. A compromised system could interfere with monitoring, communications, or emergency response functions.
Utilities and Infrastructure: Electrical, Lighting, and Power Management
What's included: Electrical distribution controls, lighting systems, backup power monitoring, and energy management systems.
What It Does: These systems help facilities monitor and manage electricity use, distribute power, control lighting, and maintain essential building functions.
How It's Vulnerable: Network-connected controllers and remote management platforms create additional points of access for attackers. Outdated firmware, poorly secured connections, and compromised administrator credentials could allow unauthorized changes to system settings or disrupt essential operations. NIST and GAO identify electrical and lighting systems as components of building automation infrastructure that require cybersecurity protections.
Fighting Back
So, what's a professional like yourself to do when it comes to pushing back against the ever-looming shadow of cybersecurity threats to your facility's vulnerable systems?
For starters, proactivity in keeping vulnerable systems up-to-date is paramount, maybe even more so than standard preventative maintenance needs. This is because while physical and enclosed digital systems help to keep your facility running efficiently and reliably, not staying on top of the latest driver updates, firmware patches, and security updates puts you in the perilous position of becoming easy prey for black hat hackers who could exploit underperforming and outdated measures. Your facility isn't actively planning sabotage against you, but cybercriminals most certainly are.
And if you think outdated systems are an unlikely target, just ask hundreds of French supermarkets that recently found themselves on the receiving end of a cyberattack. Attackers exploited vulnerabilities in connected refrigeration systems, manipulating temperature and defrost settings and causing widespread food spoilage. The incident highlights how neglected firmware and outdated security measures can turn everyday building equipment into an unexpected liability. Even a refrigerator isn't safe from hackers these days.
SOC 2 and You
You also shouldn't neglect the credibility of who is backing your cybersecurity. Working with vendors or being a vendor that has undergone a SOC 2 examination can provide greater confidence that there are established and maintained appropriate safeguards for protecting sensitive information and systems.
Developed by the American Institute of Certified Public Accountants (AICPA), SOC 2 reports evaluate an organization's controls against criteria such as security, availability, processing integrity, confidentiality, and privacy. While no report guarantees complete protection against cyberattacks, knowing that your cybersecurity partners are independently evaluated is another important step toward keeping your facility's systems in good hands.
A Tool... or a Weapon
Not every service provider or facility manager has the luxury of a dedicated team member who specializes in digital security, although the time may come when that responsibility becomes unavoidable as cybersecurity regulations and compliance requirements become increasingly stringent. Even without a specialist, it's good practice to understand which of your facility's systems are connected, who has access to them, and how those connections are protected. Work with your IT department, service providers, and cybersecurity professionals to establish safeguards and contingency plans should something go wrong. Never forget that while modern wireless and web-based systems offer seemingly endless convenience and efficiency, those same connections could just as easily be weaponized by someone looking to do you harm.
Comments