Temperatures spiked, food spoiled, and fires broke out.
The incident fits a wider pattern of intrusions that reach beyond data theft into physical systems, including an August ransomware attack on building-management systems at a Canadian hospital that disrupted door access, central HVAC monitoring, and staff access cards, and attacks on Las Vegas casinos three years ago.
A report from ServiceNow's Armis Labs found that 73 percent of organizations own building automation systems (BAS, which control heating and cooling, lighting, door locks, cameras, and fire alarm panels) that have been used in ransomware attacks.
The same share have known exploited vulnerabilities in at least one such system, and 91 percent of BAS communicate over insecure protocols.
ServiceNow's Michael Freeman said these systems are easier to compromise and a good place to hide, and described one case in which intruders used a financial institution's building systems to keep access after being repeatedly removed from its IT network.
Semperis consultant Tim Beasley described a case where an attacker locked a customer out of its offices and police had to break windows to get in; he said the customer did not pay.
Security researchers also point to rising exposure in industrial operational technology (OT, the equipment that runs physical processes). Dragos tracked 995 ransomware attacks on industrial organizations in 2023, a figure that rose more than 87 percent in 2024, then 1,020 incidents in the first quarter of 2026 and 1,140 in the second. Dragos analysts say most cases are opportunistic, but estimate that fewer than 10 percent of OT networks have adequate monitoring. Freeman said attackers are using AI to learn obscure systems that were once hard to understand. Matt Hayden of General Dynamics Information Technology said refrigeration units are often internet-connected so owners can prove regulatory compliance, and he expects the French attacks to reflect opportunists exploiting unpatched firmware rather than a nation-state. He called the consequences small-scale but a warning of what could happen with more consequential equipment.
