TrainingSmart Building trainingTunis · Sfax · Sousse · Djerba · Upcoming datesView the calendar
ExaBuilding
BMS

Cybersecurity in Connected Buildings: When a Digital Flaw Becomes a Physical Risk

Oussama Ben JemiaOussama Ben JemiaPublished on October 14, 2026

Who it’s for: Operators, integrators, design offices and technical or IT managers.

During the night of Sunday 11 to Monday 12 October 2026, hundreds of supermarkets in France found their refrigerated display cases in forced defrost.

Here, the risk is not measured only in lost data. It is also measured in temperatures, in goods and in business continuity.

Fresh and frozen products had to be thrown away, and the whole building sector should be asking itself one question:

What happens when a digital flaw acts directly on a physical installation?

What happened

On 12 October, CERT-FR, the incident response team of the French national cybersecurity agency (ANSSI), published an official alert. It states that it is aware of "numerous compromises" of remote controllers used in refrigeration installations. The update of 13 October extends the list of equipment concerned.

The consequences on the ground have been reported by the press. The head of a major retail group described refrigerated cases "put into defrost" and raised "up to 50 degrees" (Public Sénat, in French).

What we know (as of 14 October 2026)

Confirmed by CERT-FR:

  • CERT-FR lists four families of equipment: Danfoss AK-SM and AK-SC series, Copeland xweb and Dixell xweb.
  • CERT-FR considers that attack campaigns are "probably still ongoing".
  • CERT-FR points out that exposing a management interface on the Internet goes against good practice.

Statements reported by the press:

  • The director general of ANSSI said it was "urgent" to disconnect this equipment from the Internet, or to apply very restrictive network filtering.
  • Danfoss states that most of the affected units were older products that no longer received software or security updates.
  • Cybersecurity experts explain that these systems were exposed on the Internet because of a misconfiguration.

Still to be confirmed

  • The exact number of stores affected, which varies between sources.
  • How exactly the attackers gained access: the CERT-FR alert mentions no vulnerability and no CVE identifier.
  • The identity and motives of the attackers.
  • The exact extent of the damage, beyond the losses of goods reported by the retailers.

This article does not attempt to reconstruct the attack. It looks at what it reveals for everyone who designs, integrates or operates technical installations.

A technical controller is not just an IT device

In a building, some equipment links the digital world to the physical world:

  • Refrigeration supervisors, which coordinate compressors, fans, defrost heaters and sensors;
  • HVAC controllers, which run heating, ventilation and air conditioning;
  • Communication gateways, which connect different protocols;
  • BMS supervisors, which centralise set points, alarms and history.

In business IT, a compromise can affect data, identities or the availability of services.

In technical systems (OT), it can also directly change how equipment behaves: a set point, a cycle, a temperature or a control state. The consequences are then measured in the physical world: in hours of downtime, in material losses, sometimes in risks to people’s safety.

Two security studies, one lesson

Well before this incident, security researchers had documented flaws in this kind of equipment. Two publications by the Team82 research team at Claroty are particularly telling.

They describe two different products and two different mechanisms. At this stage, neither allows us to conclude that the vulnerabilities studied were exploited in the French incident.

Refrigeration supervision: Danfoss AK-SM 800A

On 9 August 2026, Claroty published a security analysis of the Danfoss AK-SM 800A system manager, used to supervise commercial refrigeration installations. The AK-SM series is one of the equipment families listed by CERT-FR.

  • 3 vulnerabilities documented: an authentication bypass that can expose sensitive information, a command injection that allows code execution, and a configuration flaw that can cause a denial of service. The last two require the attacker to be already authenticated.
  • The researchers report finding several thousand management interfaces exposed on the Internet.
  • Danfoss has released firmware R4.3.1 to fix the vulnerabilities described (security advisory DSA-2025-08-01). The devices concerned should be checked model by model and version by version.
  • The researchers’ recommendations: update, do not expose management interfaces directly on the Internet, and restrict administration to trusted networks, VPNs or segmented networks.

On the same day, Claroty published another study on Copeland XWEB Pro refrigeration supervisors, another family listed by CERT-FR: 23 vulnerabilities, 21 of them high severity, affecting versions 1.12.1 and earlier of the models concerned, and fixed in firmware 1.13.

Building automation: EnOcean SmartServer and i.LON

On 29 April 2026, Claroty published an analysis of EnOcean’s SmartServer IoT controllers and the legacy i.LON controllers, which connect building automation networks to IP networks.

  • 2 vulnerabilities: one allows, under the conditions described by the researchers, remote code execution without prior authentication (in particular when the device is exposed on the Internet with the relevant protocol enabled); the other allows a memory information leak.
  • According to the researchers, successful exploitation makes it possible to take control of building management and automation systems.
  • For the SmartServer IoT platform, the manufacturer recommends version 4.6 Update 2 (v4.60.023) or later. The i.LON controllers are older devices: their situation should be checked model by model with the manufacturer.

What they have in common

The products, protocols and vulnerabilities are different. The lessons for operators nevertheless converge on three measures:

  1. Limit the network exposure of technical equipment and remove unnecessary direct access from the Internet.
  2. Keep software and firmware up to date when the manufacturer provides fixes, and identify equipment that is no longer supported.
  3. Segment networks, so that only the necessary traffic is allowed and the consequences of a compromise are contained.

These measures do not show how the French incident happened. They reduce the risks that connected installations are exposed to.

The CERT-FR alert stresses one immediate point: the management interfaces of refrigeration controllers must not be directly exposed on the Internet. It also recommends checking configurations, securing remote access and applying the measures recommended by manufacturers. Network segmentation complements these measures: it limits communication between technical systems, the office network and other connected equipment.

How a flaw becomes a physical risk

Depending on the installation, taking control of a piece of technical equipment can lead to:

  • Changed set points: temperatures, schedules, alarm thresholds;
  • Triggered cycles: defrost, stop, restart;
  • Loss of supervision: hidden alarms, screens showing normal values;
  • Service interruption: heating, cooling, ventilation, lighting, access control;
  • A jump to other systems, if the network is not segmented.

The consequences are therefore physical and economic: lost goods, discomfort or business interruption, equipment pushed outside its normal operating range, emergency call-outs.

This is not a theoretical risk reserved for large sites. The same families of equipment are found in shops, hotels, offices, healthcare facilities and industrial buildings.

Design and operating mistakes to avoid

The October incident does not say that connected buildings are dangerous. It says that connection without architecture is dangerous.

The most common mistakes:

  • Exposing an administration interface directly on the Internet, often to make remote maintenance easier.
  • Not keeping an inventory of connected equipment, its versions and its access points.
  • Keeping end-of-life equipment in service when it no longer receives fixes.
  • Keeping default passwords, or sharing a single account between several people.
  • Putting the technical network and the office network on the same level, without segmentation.
  • Granting permanent remote access to contractors, without control or traceability.
  • Not backing up configurations, which makes any recovery slow and uncertain.

None of these mistakes is spectacular. That is exactly why they persist.

10 essential checks to secure a connected BMS or control installation

These checks do not replace an audit. They help you see where you stand, and identify what requires a specialist.

(O): a check the operator can carry out. (S): to be entrusted to a specialist in the security of technical (OT) systems. These labels show the usual level of intervention, not a strict boundary: depending on how critical the site is, an apparently simple operation may require a specialist.

  1. Inventory (O) List connected controllers, supervisors and gateways: brand, model, firmware version, location, responsible contractor.
  2. Internet exposure (O then S) The operator can check the known configuration of the router, the firewall and the access given to contractors. But the absence of exposure cannot be confirmed from a local screen: a check from outside the network, by a specialist, is the only way to be sure.
  3. End of life (O) Identify equipment that no longer receives updates, and plan its replacement or isolation.
  4. Updates (S) Apply the fixes published by manufacturers, following a procedure tested and agreed with the operator.
  5. Accounts and passwords (O) Remove default passwords, create one account per person, delete unused accounts.
  6. Remote access (S) Replace direct access with secure access (VPN or a dedicated access solution), limited in time and logged.
  7. Network segmentation (S) Separate the technical systems network from the office network and from the Internet, and allow only the necessary traffic.
  8. Configuration backups (O) Keep an up-to-date copy of configurations and reference set points, so they can be restored quickly.
  9. Anomaly monitoring (O then S) Be alerted to a set point change, an unusual cycle or an unexpected connection, and regularly check that settings are consistent.
  10. Incident procedure (O then S) Know who to call and how to isolate a device. If a compromise is suspected, do not improvise: coordinate isolation, the preservation of evidence useful for analysis, and the return to service with those responsible for the installation and, if necessary, a specialist. Also plan when and how to report the incident to the authorities.

For the October incident, CERT-FR recommends in particular removing Internet exposure, checking the entire configuration (including defrost ranges), restoring access only through a VPN or a protected network and, for a compromised device, resetting it and then reconfiguring it before putting it back into service. It points out that a reset is not enough if an end-of-life device remains exposed.

Building cybersecurity in from the design stage

A building’s cybersecurity is not added at the end of a project. It is decided when the architecture is defined:

  • Which equipment needs to communicate, and with what;
  • Which paths supervision and remote maintenance take;
  • Who has access to what, and how that access is controlled;
  • How the installation will be updated, backed up and monitored throughout its life.

It is the same logic as for interoperability or maintainability: a choice made at the start saves years of constraints.

A connected building does not become smart simply because its equipment communicates. It must also remain manageable, secure and resilient throughout its life.

Would you like to review the exposure of your technical installations? Talk to an expert

Sources

Official source

Security research

Press (in French)

Oussama Ben Jemia

Oussama Ben Jemia

Related training : Integration & Interoperability of Smart Building SystemsRelated training : IP Networks for Smart BuildingRelated training : Smart Building Project Design & Engineering
Related expertise : Smart Building AuditRelated expertise : Smart Building Design & Integration