
A few years ago, the cybersecurity conversation in facilities management centered on the Colonial Pipeline ransomware attack and a growing realization that connected building systems had become a doorway for hackers. That doorway is now wider, and the people walking through it have new tools. Artificial intelligence helps attackers write convincing phishing emails, clone executive voices, scan the internet for vulnerable equipment, and even carry out much of an intrusion on their own. For facility managers across Nassau and Suffolk counties, cybersecurity can no longer be handed off entirely to IT. If you manage HVAC controls, access systems, elevators, lighting, metering, or the vendors who service them, you are managing cyber risk whether your job description says so or not.
How AI-Powered Cyberattacks Are Changing the Threat Landscape
The recent buzz about "getting hacked by AI" is grounded in real events. In November 2025, Anthropic reported that it had detected and disrupted a cyber espionage campaign in which a Chinese state-sponsored group manipulated its Claude Code tool to attack roughly 30 organizations, including technology companies, financial institutions, chemical manufacturers, and government agencies. A small number of those intrusions succeeded. What made the case notable was how little human effort it required. According to Anthropic, AI performed 80 to 90 percent of the campaign, with people stepping in at only four to six key decision points. The attackers slipped past the model's safeguards by breaking the attack into small, innocent-looking tasks and claiming they were running defensive security tests.
Facility managers should take two lessons from this. First, the skill barrier for sophisticated attacks has dropped. Work that once required a team of experienced hackers can now be automated, which means smaller criminal groups can go after organizations that used to fly under the radar, including property management firms, school districts, and mid-sized commercial buildings. Second, attacks move faster. At its peak, the AI in that campaign made thousands of requests, often several per second. The Verizon 2026 Data Breach Investigations Report reinforces the trend: exploiting software vulnerabilities is now the most common way attackers get in, accounting for 31 percent of breaches, and generative AI is now boosting 15 different attack techniques. When a flaw in a building controller becomes public, the window to patch it is shrinking.
Deepfakes, Voice Cloning, and AI Phishing Aimed at Facilities Teams
The classic advice to train employees still holds, but the scams have changed. Older phishing emails were often easy to spot because of clumsy grammar and generic greetings. AI now produces messages that are polished, personalized, and timed to real projects. The FBI's 2025 Internet Crime Report tracked artificial intelligence as a factor for the first time, logging more than 22,000 complaints and about $893 million in losses that involved AI. Business email compromise alone cost victims more than $3 billion, and New York ranked fourth in the nation for both complaints and reported losses.
Deepfakes have moved from novelty to real fraud. In one widely reported case, a finance employee at the global engineering firm Arup sent about $25.6 million to fraudsters after joining a video call where the CFO and other colleagues were all AI-generated fakes. Facilities departments are natural targets for this kind of scheme because they handle a steady stream of vendor invoices, emergency service calls, and payment changes. Picture a call that sounds exactly like your building owner authorizing an urgent roof repair payment, or an email from a "mechanical contractor" asking you to update its bank account on file. Verizon also found that people click on mobile phishing about 40 percent more often than on email, so text messages sent to technicians' phones deserve attention too.
Why Building Automation Systems Are a Prime Target
Building management and automation systems were designed for reliability, not security, and many ran for years on isolated networks. That is changing as owners connect them for remote monitoring, energy analytics, and sustainability reporting. Research from Claroty's Team82, which examined more than 467,000 building management devices across 529 organizations, found that 75 percent of organizations had devices affected by known exploited vulnerabilities, 69 percent had devices with flaws already used in confirmed ransomware attacks, and 51 percent had vulnerable devices insecurely connected to the internet. The researchers pointed to common protocols such as BACnet and Modbus that lack built-in encryption, widespread default or hard-coded passwords, and unmanaged remote access tools installed by third parties.
The old rule of thumb still applies: if a system connects to the internet, or to anything that connects to the internet, it is vulnerable. What has changed is scale. Automated tools can sweep the internet for exposed controllers and match them to known flaws far faster than any person, so an exposed BMS login page is no longer safe simply because it is obscure.
Lessons From the Suffolk County Ransomware Attack
Long Island does not need to look overseas for a cautionary tale. In September 2022, the BlackCat ransomware group attacked Suffolk County's systems. A bipartisan Suffolk County Legislature report found that the attackers first got in through a Log4j vulnerability in December 2021 and spent months inside before deploying ransomware. The county refused to pay a ransom demand that started at $2.5 million, but estimated response and remediation costs climbed to $25 million. The county's main website was down for more than five months, 911 operations were affected, and vendors could not submit vouchers or get paid.
Several of the report's findings will sound familiar to anyone who runs buildings:
- Default passwords were left in place on at least one key piece of infrastructure hardware, apparently to make vendor access easier.
- Some firewalls had reached end-of-life and even end-of-support but remained in service.
- A security team of no more than four people received hundreds of alerts a day and rerouted them to a chat channel, where critical warnings went unaddressed.
- The county had no written cyberattack response and recovery plan, despite recommendations dating back to 2019.
Each of these has a parallel in building operations: the controls contractor who asks you to keep the factory login, the aging BMS server nobody wants to budget to replace, and the alarm fatigue that comes from monitoring systems that cry wolf.
New York Cybersecurity Regulations Facility Managers Should Know
New York has tightened its rules in ways that reach facilities operations. Under a state law signed in June 2025, municipal corporations and public authorities must report cybersecurity incidents to the Division of Homeland Security and Emergency Services within 72 hours, report any ransom payment within 24 hours, and explain the payment within 30 days. If you manage facilities for a county, town, village, or public authority, your building systems are part of that picture. The DHSES Cyber Incident Response Team also offers no-cost support to local governments, special districts, public schools, and BOCES.
Private owners have obligations as well. The SHIELD Act requires any business that keeps New Yorkers' private information to maintain reasonable administrative, technical, and physical safeguards, including choosing service providers that can protect that data and requiring those safeguards by contract. That matters if your access control system stores employee credentials or your tenant portal holds personal information. A December 2024 amendment now requires notifying affected residents within 30 days of discovering a breach. Healthcare facilities face stricter requirements still. General hospitals have been subject to the full Department of Health 10 NYCRR 405.46 cybersecurity regulations since October 2025, including naming a chief information security officer and conducting annual risk assessments. Facility leaders at Long Island hospitals should confirm that connected building systems are included in those assessments.
A Practical Cybersecurity Action Plan for Long Island Facilities
You do not need to become a security engineer to make a real difference. Joint federal guidance from CISA, the FBI, EPA, and DOE on reducing cyber threats to operational technology lines up closely with what facility managers can control directly. Start here:
- Build a connected asset inventory. List every controller, gateway, camera, access panel, meter, and smart device, along with who services it and how it connects. You cannot protect what you do not know you have.
- Take building systems off the public internet. CISA notes that exposed operational technology is quickly found with simple search tools. If remote access is essential, require a VPN or private network connection.
- Eliminate default passwords. Change factory credentials on every device at commissioning and make it a line item in contractor closeout documents.
- Control vendor remote access. Require phishing-resistant multifactor authentication, individual accounts for each technician, and access limited to the specific systems involved. Disable dormant accounts promptly.
- Segment your networks. Keep building systems separate from business networks and guest Wi-Fi so an infected laptop cannot reach your chiller plant.
- Plan for patching and lifecycle replacement. Add firmware updates to preventive maintenance schedules and budget to replace controllers and servers before they lose vendor support.
- Verify every payment change separately. Confirm bank detail changes and urgent payment requests by calling a known number on file, never one provided in the message. Consider a code word for high-dollar approvals.
- Update training for AI-era scams. Teach staff that a familiar voice or face on a video call is no longer proof of identity, and include text messages in simulated phishing exercises.
- Practice manual operations. Document and drill how to run heating, cooling, and access control without the BMS. CISA stresses this ability to keep operating after an incident.
- Write and test an incident response plan. Know who to call, including IT, your controls vendor, legal counsel, your insurer, and the authorities, and run at least one tabletop exercise each year.
Budget does not have to stop you from getting started. CISA offers free cyber hygiene services, including external vulnerability scanning, phishing assessments, remote penetration testing, and a self-assessment tool with a ransomware readiness module. The FBI also recommends encrypted, immutable, offline backups so you can restore systems without paying a ransom.
Building a Cyber-Resilient Facilities Team for the AI Era
Technology alone will not close the gap. The Suffolk County report traced much of the damage to poor coordination between separate IT teams, understaffing, and limited training. Those same problems show up wherever facilities and IT operate in silos. Regular joint meetings, shared ownership of building network diagrams, and a clear escalation path for strange system behavior go a long way toward fixing them.
Procurement is another lever. When specifying new controls, ask vendors how they handle patches, remote access, encryption, and default credentials, then write those expectations into contracts. The FBI's data shows why this matters to the trades: among ransomware complaints from businesses outside critical infrastructure sectors, contracting services made up 17 percent and engineering and architectural firms another 10 percent. Your vendors are targets, and their access to your buildings can quickly become an attacker's access.
Finally, AI cuts both ways. The same capabilities attackers exploit can help defenders sort through alarms, spot unusual equipment behavior, and flag suspicious messages, and Anthropic itself advises security teams to experiment with AI for threat detection and incident response. Facility managers who pair smart tools with disciplined fundamentals, such as unique passwords, segmented networks, verified payments, and practiced response plans, will be far better positioned than those waiting for the next headline to make the case for them.
If you're an IFMA-LI member, please log in so you can comment on this article.
Read More










