PROTECTING YOUR BUSINESS
THE TARGET BREACH: WHAT A BMS VENDOR ACCESS FAILURE LOOKS LIKE IN PRACTICE
When an HVAC or access-control system sits unsegmented on the same network as everything else,“ Who can adjust the thermostat?” and“ Who can reach tenant financial records?” can end up having the same answer. That’ s not a hypothetical. It’ s the exact structural condition behind one of the most-cited breaches in retail history.
The Target breach, now over a decade old, originated through credentials stolen from an HVAC vendor with remote access into Target’ s network. Once inside, the attacker moved from the building-systems side into the systems handling customer payment data. It’ s an old case, but it’ s the one that put vendor access on the map as a named category of risk, and the pattern hasn’ t gone anywhere since.
More recently, in September 2023, Johnson Controls, the world’ s largest building automation vendor, was hit by a ransomware attack that stole an estimated 27 terabytes of data, including building floor plans, industrial control system designs, and security details for buildings the company serviced, reportedly including U. S. federal facilities.
The company confirmed remediation costs exceeded $ 27 million. A different mechanism than Target, the same underlying lesson:
The vendor managing a building’ s systems is a high-value target, and a compromise on their end can expose exactly the kind of building-specific access and design information that makes every property they service more vulnerable.
That exposure doesn’ t stay in the IT department. It reaches the balance sheet, which is why the vendor managing a building’ s systems has become a concern that financial leadership can no longer delegate entirely to IT. The vendor wasn’ t the target in either case. The vendor was the boundary nobody had drawn.
These security gaps are, increasingly, the kind of thing that surfaces at the worst possible moment: during a lender’ s due
6 ProtectMyIT. com