Request assessment

Home / Industries / Building Automation Systems

Building Automation Systems · BAS/BMS · HVAC · Retail Refrigeration · Building Controls OT

Building OT security for stores, campuses, and facilities that keep people comfortable and product cold.

Grocery and retail, cold storage, data centers, hospitals, campuses, and commercial real estate all run building automation system cybersecurity risk on the same class of systems: BAS/BMS, HVAC, retail refrigeration, instrument air, and the vendor remote access paths that connect them. Red Tiger Security runs a plant-safe facility OT assessment of those live systems without shutting the site down. Then the team fixes what is hurting operations now. If you want Red Tiger to stay, a small OT firewall and network sensor go in at the site, the team watches those assets 24x7 with the Red Tiger SOC, and you get OT managed security services (MSP) + Metrics and Reports.

Request an assessmentBook a call

How to get started securing your Building Automation Systems

Three steps: assess the live building OT, harden it with a per-site OT firewall and network sensor, then watch it 24x7 with the Red Tiger SOC under OT managed security services (MSP).

Step 1
1

Assess

Plant-safe OT assessment of BAS/BMS, HVAC, refrigeration, and field protocols — without disrupting operations.

Step 2
2

Harden

Fix the immediate need: remove internet exposure, control vendor remote access, and add a per-site OT firewall and network sensor.

Step 3
3

Monitor 24x7

24x7 SOC with OT MSP + Metrics and Reports — alerts on logins, setpoints, and defrost changes.

Oct. 11, 2026An attacker hit refrigeration controllers at about 700 French supermarket stores, forcing long defrost cycles. [1]
Early Nov. 2026Similar attacks spread to about 10 more European countries, plus three French blood-bank refrigeration systems. [1]
Shared patternInternet-reachable controllers, weak default logins, unsupported firmware, and a few contractors managing hundreds of stores. [1]

Who this is for

OT security for commercial buildings across grocery and retail, cold storage, data centers, hospitals, campuses, and commercial real estate — plus the HVAC and refrigeration contractors who maintain them.

SectorWhat building OT usually includes
Grocery and retailRetail refrigeration cybersecurity, display cases, walk-ins, HVAC, BAS/BMS head-end, vendor remote access
Cold storageFreezer and cooler controllers, leak detection, refrigeration racks, contractor remote maintenance
Data centerCRAC/CRAH, chiller plant, generator and UPS monitoring, building controls OT security at the facility edge
HospitalHVAC cybersecurity for patient areas, medical gas interfaces where present, life safety systems, BAS
Campus and commercial real estateSmart building cybersecurity, multi-building BMS, boiler and chiller controls, access control and CCTV security

Why this matters now

The Europe freezer campaign is not just a European story. The same controller families and remote-maintenance model show up in U.S. stores and cold chain sites. On Nov. 5, 2026, CISA, the FBI, HHS, USDA, and DOT published a joint fact sheet on U.S. refrigeration and cold chain risk. [2]

According to Dark Reading's Nov. 6, 2026 reporting, the Oct. 11 incident caused millions of euros in damage across roughly 700 affected stores in France alone: spoiled food, damaged equipment, and some reported fires. The technology included Danfoss refrigeration controllers and Dixell and Copeland XWEB systems. How the attacker first got in has not been publicly confirmed. What is clear is the exposure pattern: internet-accessible web servers, default login credentials, and legacy products that no longer receive updates. [1]

Read Red Tiger's related advisory: U.S. refrigeration and cold chain joint fact sheet.

What building OT is: BAS, BMS, BACnet, Modbus, and how it differs from IT

Building OT

Controls that move air, heat, cold, and power

Operational technology (OT) in a building is the controllers and networks that run refrigeration, heating, ventilation, and air conditioning (HVAC), lighting, energy meters, and generators. Building automation systems (BAS/BMS) commonly integrate or interface with fire and gas detection, CCTV, and badge access control, along with elevators and other life-safety links. A wrong command here changes temperature, airflow, door state, or alarm response. The result is physical: spoiled product, an overheated control room, or a comfort and safety problem for people on site.

IT

Business systems and office networks

Information technology (IT) runs email, point of sale, corporate apps, and office Wi-Fi. IT failures hurt data and uptime. Building OT failures hurt the process the building is there to support. Many sites still treat BAS and refrigeration as facilities problems, not as OT that needs the same care as a plant control network.

Where OT lives in a store, campus, or facility

Across grocery, cold storage, CRE, campuses, and mixed-use sites, OT shows up on the roof, mechanical room, utility entrance, sales floor, refrigeration, and site—plus remote/cloud paths. Fire/gas, CCTV, and badge access usually sit under building automation via the BAS/BMS head-end. The diagram maps a typical facility; open a group for each system.

Many of these systems are also IoT/IIoT: smart thermostats, wireless sensors, cameras, and cloud-connected controllers — in scope too.

Cutaway of a commercial building and grocery wing with numbered BAS OT callouts for HVAC, head-end, refrigeration, access, CCTV, generators, and remote access
Illustrated cutaway — equipment sits where it typically lives. Numbered callouts match the key and groups below.

Diagram key — where building OT lives

  1. Rooftop units (RTU)
  2. Cooling towers
  3. Roof condensers
  4. Lighting / IoT gateways
  5. BAS/BMS head-end
  6. Supervisory controllers
  7. Air handlers (AHU)
  8. Chillers
  9. Boilers / steam
  10. VAVs and zone dampers
  11. Instrument air compressor
  12. Compressed air / plant air
  13. Thermostat / zone sensors
  14. Steam rooms / saunas
  15. Domestic hot water
  16. Electrical metering
  17. Switchgear / UPS / generators
  18. Natural gas / fuel oil
  19. Water / backflow / boosters
  20. Refrigeration racks
  21. Walk-in coolers/freezers
  22. Reach-in / process coolers
  23. Display cases
  24. Leak / refrigerant detection
  25. Badge access / access control
  26. CCTV
  27. Elevators
  28. Fire alarm and gas detection
  29. Irrigation / lift / pumps
  30. EV chargers
  31. Parking controls
  32. Network closet / OT firewall
  33. Cloud / BMS portal
  34. Vendor remote access

Zones: 1–4 rooftop · 5–12 mechanical · 13–19 utility/sales · 20–24 refrigeration · 25–28 life safety · 29–34 site/remote.

Mobile zone list of where building OT systems live, with fire and gas, CCTV, and badge access under building automation
Zone list for smaller screens. Building automation includes life safety and security. Open a group below for what each system does.
ARM  Core serviceARM  Dashed: where it fits the site and the riskA Assess · R Remediate · M Monitor
Rooftop4 systems
1. Rooftop units (RTU). Packaged heating and cooling on the roof. A wrong setpoint or lockout can take zones offline.
ARM
2. Cooling towers. Reject heat from the chilled-water plant. Fan or basin control faults raise condenser temperature and trip chillers.
ARM
3. Roof condensers. Air-cooled condensers for HVAC and related heat rejection on the roof deck.
ARM
4. Solar. Rooftop PV and monitoring that often shares contractor or gateway paths with other building systems.
ARM
Mechanical room / central plant5 systems
5. Chillers. Central cooling plant that feeds chilled-water loops for AHUs and process loads.
ARM
6. Boilers and steam plant. Heating and steam for comfort, domestic hot water, and process loads.
ARM
7. Air compressors and instrument air. Supply clean, dry air for pneumatic valves and actuators. Loss of instrument air can stop those devices.
ARM
8. Pumps. Chilled-water, condenser-water, and other plant pumps that keep loops moving.
ARM
9. Switchgear and UPS. Indoor electrical distribution and uninterruptible power for critical rooms and controls.
ARM
Utility service entrance7 systems
10. Pad-mount transformer. Utility transformer on the exterior pad that steps power down for the building.
ARM
11. Electric meters. Utility service meters and submeters at the exterior wall.
ARM
12. Gas service and meter. Natural gas meter and regulators that feed boilers and appliances.
ARM
13. Water service. Domestic water entry and related monitoring at the service entrance.
ARM
14. Backup generators. Standby gensets on an outside pad beside the building.
ARM
15. Fuel tank. Generator fuel storage on the same pad, with level and leak monitoring.
ARM
16. Automatic transfer switch (ATS). Transfers critical loads between utility and generator power.
ARM
Sales floor / back-of-house refrigeration5 systems
17. Refrigerated display cases. Aisle and end-cap cases that keep product cold on the sales floor.
ARM
18. Case controllers. Local controllers on each case under a site refrigeration supervisor.
ARM
19. Walk-in coolers and freezers. Box-level temperature and defrost control for storage rooms.
ARM
20. Refrigeration rack room. Rack compressors and controls that keep product cold across cases and walk-ins.
ARM
21. Refrigeration condensers. Heat rejection for the refrigeration plant, on the wing roof or a side pad.
ARM
Office floors and BAS head-end3 systems
22. VAV boxes. Zone airflow that keeps spaces within range; many sites have dozens or hundreds.
ARM
23. Thermostats and IoT sensors. Smart thermostats, wireless temperature, humidity, and occupancy devices that feed the BAS or a cloud app.
ARM
24. BAS / BMS head-end and network closet. The building management system operators and contractors use to see and change setpoints, plus the network closet that ties field systems together.
ARM
Building automation: life safety and security4 systems
25. Badge access control. Door controllers and badging that the BAS commonly integrates or interfaces with; often share contractor remote-access paths.
ARM
26. CCTV. Cameras and NVRs, including cloud-connected platforms, typically tied into the same building automation and security picture.
ARM
27. Elevators. Vertical transport controls that interface with fire and access systems; often maintained by a separate vendor with remote access.
ARM
28. Fire alarm and gas detection. Fire and gas panels and life-safety interfaces to HVAC shutdown, dampers, and elevators—usually included as part of building automation.
ARM
Amenities2 systems
29. Steam rooms and saunas. Where present (fitness, spa, hotel amenity), steam and heat controls that can overheat or fail unsafe if setpoints are changed.
ARM
30. Pool equipment. Pool pumps, heaters, and chemistry controls tied into building or amenity systems.
ARM
Site / parking2 systems
31. EV chargers. Parking-lot chargers and their network gateways.
ARM
32. Gate controls. Parking gate arms and access readers at the lot entrance.
ARM
Remote access and cloud2 systems
33. Cloud gateway. Site-to-cloud bridges for BAS, refrigeration, and OEM telemetry.
ARM
34. Vendor remote access. Contractor and OEM remote-maintenance channels that can reach BAS, refrigeration, fire and gas, CCTV, and access control across many sites.
ARM

How one exposed controller becomes physical damage

Building OT does not fail quietly into a help-desk ticket. It fails into product loss, equipment damage, and comfort or safety problems.

In the French supermarket case, compromised refrigeration controls forced extended defrost cycles. Dark Reading reported spoiled food, damaged equipment, some fires, and millions of euros in losses across about 700 stores, with later spread across Europe and into blood-bank refrigeration. The initial access vector remains unconfirmed; the reusable pattern is the exposed setup. [1]

Why these systems get missed. Facilities or refrigeration contractors often own them, outside IT security. Lifecycles run for years or decades. Firmware goes unsupported. Each site looks like “just a few controllers,” until the same pattern is running at hundreds of locations. [1]

Incident timeline: BAS cybersecurity, HVAC hacking, and cold storage / freezer cyberattack cases

Every entry is from a named public source. Supporting systems and contractor access keep showing up as the way in.

2013

Target via HVAC contractor

Stolen credentials from HVAC contractor Fazio Mechanical (billing/project-management link) — not an attack through Target’s BAS.

[3] Krebs on Security

2016

Lappeenranta heating

DoS on building-automation heating and hot-water controls in two Finnish buildings until they were taken offline.

[4,5] Public reporting

2017

Casino fish-tank sensors

Internet-connected fish-tank sensors used as a path into a North American casino network.

[6] CNN / Darktrace

2021

Verkada camera breach

Cloud camera platform compromised; live and archived video exposed for a subset of customers.

[7,8] Verkada / press

2026

EU supermarket freezers

Refrigeration controllers at ~700 French stores forced into long defrosts — spoilage, damage, millions of euros lost.

[1] Dark Reading, Nov. 6, 2026

2026

EU spread & blood banks

Same pattern in ~10 more EU countries; three French blood-bank refrigeration hits stopped before plasma damage.

[1] Dark Reading, Nov. 6, 2026

See what is exposed at your sites

Tell Red Tiger which stores, campuses, or facilities belong in scope. Plant-safe assessment. No shutdown.

Request an assessmentBook a call

If building automation, HVAC, refrigeration, instrument air, or building controls go down, operations feel it

From Red Tiger field assessments: these supporting systems belong in OT scope.

In many of our OT cybersecurity assessments, we still have to convince asset-owner clients to put building automation, HVAC, refrigeration, instrument air, and building controls in scope. They are easy to leave off the list because they sit under facilities or a contractor, not under the control room. That is a mistake.

When these systems fail, the process feels it. Losing instrument air can stop pneumatic valves and actuators. HVAC or cooling failures can overheat control rooms and server rooms. Refrigeration loss spoils product. The same systems often share networks or remote-access paths with the plant, and nobody on the security side owns them, so they become the overlooked way in.

We recommend including these systems in every OT assessment scope. Walk the perimeter down through the contractor paths and into the controllers that keep the site running, not only the PLCs that run the main process.

Exposed setup vs hardened building OT

A plain comparison of the pattern Dark Reading described and the protect pattern Red Tiger puts in place at a site.

Comparison table: exposed building OT setup versus hardened setup with per-site firewall and monitoring
TopicExposed setupHardened setup
Controller reachabilityWeb servers reachable from the internetControllers off the public internet
LoginsDefault or weak shared credentialsUnique credentials, owned and rotated
FirmwareUnsupported legacy products still onlineLegacy devices isolated when they cannot be patched
Vendor accessOpen remote-maintenance paths across many storesTime-limited, logged, controlled vendor access
DetectionNo alert when setpoints or defrost changeAlerts on controller logins and setpoint / defrost changes
ScaleSame risky pattern at hundreds of sitesRepeatable protect pattern at each store or site

Protect pattern: controllers, vendor remote access, OT firewall and network sensor, then 24x7 SOC. See How to get started.

First steps for building controls OT security

1. Inventory

List BAS, HVAC, refrigeration, instrument air, and building-control assets, including who maintains them and how they connect.

2. Remove internet exposure

Take controller web interfaces off the public internet. Put a per-site firewall in front of the controls.

3. Change default passwords

Replace default and shared logins. Own the credentials; do not leave them with a vendor alone.

4. Control vendor access

Make remote maintenance time-limited, logged, and approved. Know which contractor can reach which site.

5. Monitor setpoint changes

Alert on controller logins and on setpoint or defrost changes that do not match normal operations.

6. Plan the hard cases

Isolate devices that cannot be patched. Add independent temperature alarms where product or patient material is at risk.

Assess, fix the immediate need, then watch 24x7

The same three-step model Red Tiger uses for water and other plant environments, applied to building automation system cybersecurity, HVAC cybersecurity, and retail refrigeration cybersecurity.

Then the team fixes what is hurting operations now. If you want Red Tiger to stay, a small firewall and sensor go in at the plant, the team watches those assets 24x7 with the Red Tiger SOC, and you get 24x7 MSP + Metrics and Reports.

Step 1
1

Plant-safe assessment

  • Inventory BAS, HVAC, refrigeration, BMS, and instrument-air controllers
  • Find internet exposure, default credentials, and unsupported firmware
  • Map contractor remote-access paths across stores or sites
  • Work beside facilities and the refrigeration contractor, not around them
  • Map findings to NIST CSF and ISA/IEC 62443
The plant-safe assessment →
Step 2
2

Fix the immediate need

  • Remove internet exposure from controllers
  • Install a per-site OT firewall and network sensor in front of the controls
  • Put vendor remote access under control
  • Change credentials and isolate legacy devices that cannot be patched
Fix the immediate need →
Step 3
3

24x7 MSP + Metrics and Reports

  • 24x7 SOC monitoring of the assets the team assessed
  • Alert on controller logins and setpoint or defrost changes
  • Metrics and reports on the cadence you set
  • Optional incident response retainer
24x7 MSP + Metrics and Reports →

For multi-site grocery and facilities portfolios, the protect pattern is designed to repeat store by store or site by site. Talk with the team about how that fits your footprint. No public price list is published on this page.

Ready for step 1?

Start with a plant-safe assessment of the BAS, HVAC, refrigeration, and building controls that keep the site running.

Request an assessmentBook a call

Partner note for HVAC and refrigeration contractors

Refrigeration and HVAC service contractors sit in the middle of this problem and can be part of the fix. Red Tiger works with contractors who want a clear, plant-safe way to harden the sites they maintain: inventory, remove internet exposure, control their own remote access, and leave the owner with monitoring that makes sense to facilities and security. If that is your business, ask about a partner conversation when you request an assessment.

References

Numbers match the bracketed citations on this page. Sources checked Nov. 8, 2026.

  1. Alexander Culafi, Dark Reading, “Why Europe’s Freezer Hacks Spread So Far, So Fast,” Nov. 6, 2026. https://www.darkreading.com/ics-ot-security/europes-freezer-hacks-spread-so-far-so-fast
  2. Red Tiger Security advisory, U.S. refrigeration and cold chain joint fact sheet (CISA / FBI / HHS / USDA / DOT), Nov. 5, 2026. https://www.redtigersecurity.com/advisory/us-refrigeration-cold-chain-csa
  3. Brian Krebs, Krebs on Security, “Target Hackers Broke in Via HVAC Company,” Feb. 5, 2014 (Fazio Mechanical attribution and Fazio statement on billing/project-management connection). https://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/
  4. Security Ledger, “Let’s Get Cyberphysical: Internet Attack shuts off the Heat in Finland,” Nov. 2016. https://securityledger.com/2016/11/lets-get-cyberphysical-ddos-attack-halts-heating-in-finland/
  5. Yle, “Communications watchdog: Criminals behind home automation system cyber attack.” https://yle.fi/a/3-9278770
  6. CNN Money, “A smart fish tank left a casino vulnerable to hackers,” July 19, 2017. https://money.cnn.com/2017/07/19/technology/fish-tank-hack-darktrace/index.html
  7. Verkada, Security Update / Incident Report, March 2021. https://www.verkada.com/security-update/report/
  8. Associated Press, “Security camera hack exposes hospitals, workplaces, schools.” https://apnews.com/article/hacking-california-e7b942f436f11b9feb7dc704d4eb3a6b

Related industries and services

Building automation system cybersecurity FAQ

Common questions about BAS cybersecurity, BMS cybersecurity, HVAC hacking risk, and OT security for commercial buildings.

What is a building automation system and why is it OT?

A building automation system (BAS/BMS) is the control layer for building management system security. It runs HVAC, boiler and chiller controls, lighting, and often interfaces to access control and CCTV, life safety systems, and generator and UPS monitoring. Those controllers speak BACnet, Modbus, LonWorks, KNX, and Niagara/Tridium — BACnet security included. That is OT: wrong setpoints change temperature, refrigeration, and safety in the physical world.

Can HVAC or refrigeration be hacked?

Yes. HVAC hacking and refrigeration controller security failures usually start with internet-reachable controllers, default passwords, unsupported firmware, or open vendor remote access. Recent cold storage / freezer cyberattack reporting in Europe followed that pattern on supermarket and blood-bank refrigeration — the same model shows up in U.S. grocery, retail, and cold chain sites.

How did the Target HVAC breach involve an HVAC vendor?

In the Target HVAC breach, attackers used stolen network credentials from Target's HVAC contractor, Fazio Mechanical. That foothold was on the contractor's billing and project-management connection into Target's corporate network — not a path through the building automation system itself. It is still the case most facilities teams cite when they ask whether vendor remote access belongs in scope.

Should BAS be in our OT assessment scope?

Yes, if the site runs building controls that can stop people getting comfortable air, keep product cold, or touch life safety. A facility OT assessment should cover BAS/BMS cybersecurity, HVAC cybersecurity, retail refrigeration cybersecurity, instrument air, and the building IoT/IIoT devices tied into those loops. Smart building cybersecurity is the same walk Red Tiger already does on plants: perimeter down to the field devices.

How does Red Tiger assess BAS without disrupting operations?

The work is plant-safe on live OT. The team inventories controllers, maps vendor remote access, and looks for internet exposure and weak credentials beside facilities and the HVAC or refrigeration contractor. Findings are mapped to NIST CSF and ISA/IEC 62443 so the board and the OT engineers share one language. Controllers are not taken offline for the assessment.

What does the firewall/sensor and 24x7 SOC monitoring involve?

If you want Red Tiger to stay, a small OT firewall and network sensor go in at the site in front of the building controls. The team watches those assets 24x7 with the Red Tiger SOC, and you get OT managed security services (MSP) + Metrics and Reports on the cadence you set. Alerts cover controller logins and setpoint or defrost changes that matter to operations.

Are IoT/IIoT building devices covered?

Yes. Building IoT/IIoT security is in scope when those devices sit on the same paths as the BAS: smart thermostats, wireless sensors, cameras, cloud gateways, and refrigeration or HVAC controllers that phone home. Access control and CCTV security paths that terminate at the BAS/BMS head-end are included in the same walk.

How do we get started?

Start with a plant-safe assessment of the Building Automation Systems that keep the site running. Request an assessment on this page, or book a call. From there the team can harden the immediate need and, if you want Red Tiger to stay, put 24x7 SOC monitoring in place under the MSP close.

Request an assessment

Tell Red Tiger about the stores, campuses, or facilities you want in scope. +1.877.387.7733 · info@redtigersecurity.com · or book a call.

+1.877.387.7733
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.