Why recent cybersecurity incidents are forcing enterprise owners to rethink building systems security.

Your buildings are connected—but are they protected? Is your BAS cybersecurity posture reactive or proactive?

Over the past few years, cybersecurity incidents have made one thing clear: Building Automation Systems (BAS) are no longer isolated operational tools. They are enterprise digital assets. And increasingly, are enterprise liabilities when left unsecured.

While early examples of BAS-related breaches date back more than a decade, today’s risk landscape is far more immediate and far more consequential. Modern BAS environments are deeply integrated with IT networks, cloud platforms, and remote vendor access. That convergence has made them a high-value target for threat actors looking for quiet, persistent footholds inside enterprise environments.

And unlike traditional IT systems, BAS compromises don’t just threaten data—they can disrupt operations, damage physical assets, degrade energy performance, and impact occupant safety and comfort.

Recent BAS-Related Cybersecurity Incidents You Can’t Ignore

1. Healthcare Facilities: BAS as a Silent Entry Point (2022–2025)

Healthcare systems have become one of the most targeted sectors for cyberattacks, and recent red-team testing across U.S. hospitals shows why: BAS networks are often reachable from IT environments with minimal security controls. If your BAS shares pathways with IT networks and lacks segmentation, attackers don’t need to “break in”—they just need to log on.

In multiple assessments, attackers were able to:

  • Discover BAS devices using unauthenticated BACnet/IP traffic
  • Manipulate HVAC, air handlers, and plant equipment remotely
  • Use BAS controllers as pivot points for lateral movement across enterprise networks

The operational risk is significant. In healthcare environments, HVAC disruptions can impact infection control, patient outcomes, and regulatory compliance, making BAS attacks far more than an IT inconvenience.

2. Critical Niagara Framework Vulnerabilities Disclosed (2025)

In July 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) disclosed four critical zero-day vulnerabilities affecting the Niagara Framework, one of the most widely deployed enterprise BAS platforms in healthcare, government, and commercial real estate.

These vulnerabilities enabled:

  • Exposure of user password hashes via REST APIs
  • Remote file uploads leading to code execution
  • Session hijacking due to insecure cookies
  • Use of outdated TLS protocols by default

Even well-managed environments were exposed if patching and hardening practices weren’t actively enforced. This disclosure reinforced a hard truth: BAS cybersecurity is not about the platform you use, it’s about how it’s implemented, governed, and maintained.

3. IoT and “Non-Critical” Devices as Enterprise Backdoors

In several publicly reported incidents over the past five years, attackers gained access to enterprise systems through devices never classified as “critical infrastructure” including environmental sensors, controllers, and monitoring devices connected to building systems.

These devices often:

  • Use default credentials
  • Rely on self-signed certificates
  • Run outdated firmware with no patch lifecycle
  • Sit on flat networks alongside critical systems

Once compromised, they provide attackers with persistent, low-visibility access, the exact foothold needed for ransomware staging, credential harvesting, or data exfiltration.

Why BAS Cyber Risk Is an Enterprise Problem and Not a Facilities Issue

Across industries, the most common BAS cybersecurity failures are not exotic exploits. They are systemic gaps:

  • Unsegmented BAS and IT networks
  • Vendor remote access without enterprise controls
  • End-of-life controllers that cannot be patched
  • Protocols like BACnet/IP operating without encryption or authentication
  • Lack of ownership and visibility between Facilities and IT

From a business perspective, the impact is measurable and cyber risk in BAS environments scales with portfolio size and system complexity:

  • IBM reports the average cost of a data breach exceeded $4.5M in 2024, with operational downtime accounting for a growing share of losses
  • Ransomware incidents routinely result in days or weeks of degraded operations, even when data is recovered
  • Facilities disruptions compound losses through energy waste, deferred maintenance, and emergency response costs

How Altura’s Master Systems Integration (MSI) Approach Reduces Cyber Risk at the Source

At Altura, cybersecurity is not a bolt-on service. It is embedded in our Master Systems Integration (MSI) model. Our approach recognizes that secure buildings require secure systems architecture, not just secure devices.

What MSI Enables That Point Solutions Cannot:

  • Clear IT + OT alignment with defined ownership, standards, and escalation paths
  • Align Niagara environments with industry IT standards using the Niagara Hardening guidelines
  • Network segmentation and least-privilege access between BAS and enterprise systems
  • Lifecycle governance, including firmware tracking and end-of-life risk planning
  • Vendor-agnostic design, reducing lock-in and security blind spots

By treating BAS as an enterprise system—not a collection of controls—we help clients reduce attack surfaces, improve resilience, and protect long-term asset value.

While an enterprise approach can sound expensive in a world of tight facilities and IT budgets, we often start clients with a low-cost cybersecurity assessment to identify risk and build a long-term capital deployment strategy based on budget. 

Ready to Go Deeper?

  • Read our IT & OT Alignment White Paper
  • Watch Altura’s MSI Explainer Video
  • Explore our latest BAS Cybersecurity Insights article
  • Reach out to hear how your industry peers have leveraged our low-cost cybersecurity assessments to proactively combat threats

Because protecting your buildings means protecting what runs them—from the inside out.

Interested in what a BAS Cybersecurity Assessment can do for your enterprise?

Reach out directly to Sia Dabiri, Systems Integration expert at Altura, at sdabiri@alturaassociates.com, 949-561-8432.