A wave of cyberattacks targeting the operational infrastructure of commercial buildings is creating a new category of risk for real estate owners, one that falls outside traditional property insurance and touches tenant contracts, safety obligations and asset valuations alike. Recent incidents have seen hackers disrupt HVAC controls and elevator operations, forcing property managers to contend with both immediate downtime and the longer shadow of reputational damage.

Propmodo reports that these breaches go beyond the familiar territory of email phishing or financial fraud. Attackers are now locking building-management systems, compromising access-control panels and exploiting vulnerabilities in the sprawl of Internet-of-Things devices that underpin modern commercial real estate. In some cases ransomware events have left property managers unable to access core operational software, compounding the operational chaos when elevators freeze or climate systems fail.

The financial fallout can be direct and severe. Tenant downtime translates into business-interruption claims, and prolonged service outages may trigger breach-of-lease clauses if critical amenities remain offline. For owners of Class A towers with service-level agreements baked into leases, the exposure is especially acute. Even a few hours of lost HVAC or elevator service can ripple through tenant satisfaction scores and renewal negotiations.

Legacy infrastructure is a particular weak point. Many older buildings were designed decades before cybersecurity became a design consideration, leaving control systems that were never hardened against network intrusion. Propmodo notes that these legacy platforms remain vulnerable, often running outdated software with limited capacity for patches or encryption. Even purpose-built smart buildings are not immune: weak configuration practices and deferred patching leave gaps that sophisticated threat actors are increasingly willing to exploit.

Insurers have taken notice. Cyber coverage terms are being revised, premiums are climbing, and underwriters are asking more granular questions about building-system architecture and vendor access protocols. Some carriers are carving out or capping coverage for operational-technology incidents, pushing owners to buy separate policies or accept higher retentions. The shift reflects a broader repricing of cyber risk across commercial real estate, one that treats building systems as critical infrastructure rather than back-office IT.

Lenders and equity investors are following suit. Propmodo reports that sponsors are now being asked to demonstrate robust cyber-governance frameworks and incident-response plans as part of overall portfolio risk management. Due diligence checklists increasingly include questions about network segmentation, third-party vendor audits and disaster-recovery protocols for building-automation platforms. What was once a facilities-management concern has migrated into the investment committee and the loan-approval memo.

The threat landscape continues to evolve. Ransomware groups have shown a willingness to target not just corporate networks but the physical plant itself, calculating that the urgency of restoring heat, light and elevators will compel faster ransom payments. Access-control breaches can expose tenant data or create safety hazards if emergency systems are compromised. The convergence of information technology and operational technology in real estate has opened a new attack surface, one that many owners are only beginning to map.

For property owners, the implication is clear: cybersecurity can no longer be delegated entirely to IT departments or third-party vendors. It is now a core component of asset management, with direct links to tenant retention, insurance costs, financing terms and regulatory compliance. Buildings that cannot demonstrate resilience against cyber threats may find themselves at a competitive disadvantage in leasing markets and facing higher capital costs when refinancing or selling.