LuxHawk.lu (+352) 27 52 67 45

← Back to knowledge

When a hacker cuts the heating: the building that freezes

Buildings and co-ownership 11 min Author : Arnaud Colin Updated : 19/09/2026

Summary

Yes. In January 2024, malware sent commands to the controllers of a district heating network in Lviv and deprived more than 600 buildings of central heating in the middle of winter; in November 2016, two Finnish buildings lost heating and hot water because their controllers were reachable from the Internet without a firewall. In neither case was a software vulnerability exploited: an exposed router and an unsegmented network in Lviv, and controllers reachable from the Internet without a firewall in Lappeenranta, were enough.

Can a building be shut down over the network?

In most multi-occupancy buildings, the heating is driven by a controller installed in the boiler room. It reads sensors, commands pumps and valves, and is increasingly connected to the Internet for remote maintenance. The question a managing agent or building manager asks is simple: can an attacker act on the physical comfort of the occupants, and not only on files?

Three documented cases answer yes, each in its own way. In Lviv, in January 2024, malware sent commands to the controllers of a district heating network and deprived more than 600 buildings of heating. In Lappeenranta, in November 2016, two buildings lost heating and hot water without necessarily having been targeted. In Ukraine, in December 2015, an intrusion cut off electricity to around 225,000 customers. None of these cases rests on a technical feat: an exposed device in Lviv and Lappeenranta, and credentials stolen by phishing together with a VPN without a second factor in Ukraine, were enough.

Lviv, January 2024: more than 600 buildings without heating

The most complete case is the one that the investigation firm Dragos describes in its July 2024 report on the FrostyGoop malware. The timeline spans ten months. On 17 April 2023, the attackers entered through an Internet-exposed router belonging to the district heating operator, whose vulnerability has not been determined; according to the specialist press, it was a MikroTik model (SecurityWeek). They planted a web shell on it. In November and December 2023, they extracted credentials from the Windows registry. During the night of 22 to 23 January 2024, L2TP tunnels were opened to addresses located in Moscow, and Modbus TCP commands were sent directly to the ENCO controllers of the heating network, on port 502.

What made the attack possible comes down to three points. The router was reachable from the Internet. The network was not segmented: the router, the management servers and the controllers sat on the same network, with hard-coded network routes. And Modbus, the protocol that links the supervisory system to the controllers, has neither authentication nor encryption: any controller reachable on that port can be driven by anyone who can see it. No software vulnerability referenced by a CVE was exploited. Dragos presents FrostyGoop as the ninth known malware targeting industrial systems and the first to use Modbus TCP to act on industrial equipment; no antivirus detected it at the time of its discovery.

According to the Dragos report, the controllers’ firmware was downgraded to a version lacking the supervisory functions the operator relied on, and the operator lost visibility of its installation; the controllers then reported false readings, the water being shown as hot when it was cold, and the system stopped heating. The attackers did not seek to destroy the controllers.

The impact: more than 600 residential buildings deprived of central heating in sub-zero temperatures, and almost two days of remediation for the operator, according to Dragos. The Ukrainian authorities, quoted by The Record, speak of “more than 600 households” and name the operator, Lvivteploenergo. None of the sources consulted mentions any casualties. At the time, Dragos counted around 46,000 Modbus TCP devices exposed on the Internet worldwide.

Dragos names neither a country nor a group; it notes connections to Moscow addresses. The Baden-Württemberg State Office for the Protection of the Constitution, for its part, writes “a Russian actor”: that wording goes beyond the investigation report. On the response side, Dragos refers, in its post of 23 July 2024, to the five SANS critical controls for industrial control systems, which include network segmentation and monitoring. The pattern is not specific to Ukraine: an advisory from the US agency CISA dated 7 April 2026 describes Iran-affiliated actors manipulating Internet-exposed controllers through the same ports, including 502, in the water and energy sectors.

Lappeenranta, November 2016: two buildings left in the cold without being targeted

The second case looks more like a Luxembourg co-owned building: an ordinary building, a facilities manager and a boiler-room controller put on the Internet for remote maintenance. Between late October and Thursday 3 November 2016, the controllers of two buildings managed by the property services company Valtia received abnormal traffic. Valtia’s chief executive, Simo Rounela, explained to Vice that, under that load, the controller rebooted its control circuit every five minutes, so that the heating never restarted.

No software vulnerability, no intrusion and no malware were established. The Fidelix automation controllers, which drove the central heating and the hot water, were directly reachable from the Internet, without a firewall. The exact mechanism remains debated: the operator speaks of attacks aimed at the DNS servers it used (BleepingComputer), while the Finnish communications authority describes exposed controllers acting as amplifiers in an attack directed at another European actor. In either case, nobody needed to target these two buildings to leave them in the cold.

The remote management system no longer responded, and the technicians first went out looking for a local fault; BleepingComputer reports that it took the company a few days to understand what was happening. Once the controllers were disconnected from the Internet, the heating restarted about an hour after the alarm, according to Rounela; they were later put back on the network behind traffic filtering (Security Ledger).

The impact: heating and hot water interrupted in two buildings in sub-zero temperatures. The actual duration of the outage is not precisely established by the sources, whereas the attack lasted about a week; nobody was rehoused. The perpetrators were never identified (Etelä-Saimaa, 11 November 2016). The report that the ice of a rink in Rauma had melted during a comparable attack was denied by the town (Yle’s correction).

Fidelix’s chief executive, Jussi Rantanen, told Yle that free firewall software is supplied with the controllers, but that it has to be activated, and that “ultimately the housing company or property company is also a stakeholder”; many housing companies are reluctant to pay for a firewall. In March 2019, Yle reported that around 2,000 building controllers remained exposed on the Internet without protection in Finland.

Ukraine, December 2015: when it is the power grid that goes down

The third case does not concern a building, but the infrastructure on which every building depends: lifts, pumps, doors, boilers. On 23 December 2015, at about 3.35 pm, attackers took remote control of the supervisory screens of three regional electricity distributors and opened circuit breakers: around 225,000 customers were left without electricity in the middle of winter, according to the alert issued by the US ICS-CERT. It was the first public power outage caused by a cyberattack.

Entry took place at least six months earlier, through spear-phishing emails carrying Office documents with macros, which planted the BlackEnergy 3 malware. With the credentials stolen in this way, the attackers connected to the industrial network through the company’s VPN, using legitimate accounts and without a second authentication factor, as described in the E-ISAC/SANS report of March 2016. No software vulnerability was exploited to get in.

While they were opening the circuit breakers, the attackers wiped the workstations with the KillDisk component, replaced the firmware of the substations’ serial-to-Ethernet converters and swamped the customer call centre with a telephone denial of service. Restoration was carried out by hand, on site. According to the Idaho National Laboratory case study (2022), at least 57 substations were disconnected and operated manually for more than two months; the outage itself lasted from three to six hours depending on the company.

A year later, on 17 December 2016, the Pivnichna transmission substation near Kyiv remained out of service for a little over an hour; ESET considers the involvement of the Industroyer malware “highly probable”; one of its modules exploited the CVE-2015-5374 vulnerability in Siemens protection relays, an ancillary component that did not serve as the way in. Unlike the Lviv case, the 2015 attack has been attributed through criminal proceedings: on 19 October 2020, the US Department of Justice indicted six officers of Unit 74455 of Russian military intelligence.

What this teaches a building or co-owners’ association in Luxembourg

None of these cases happened in Luxembourg, and no hacking of a building’s technical management system there is documented in a first-rank source to date. The equipment, however, is the same: boiler-room controllers, remote management gateways, a router installed by the fitter.

  • Ask the heating operator what is reachable from the Internet. In Lviv as in Lappeenranta, the attack began with an exposed device. The maintenance contract must state which devices are accessible from outside and by whom, and provide for remote management to go through a logged VPN rather than an open port. The question applies to every contractor: the intrusion at the retailer Target, in 2013, began with the credentials of a phished heating and refrigeration contractor, according to the US Senate report; the contractor stated that this access was used only for billing, contract submission and project management, with no control of the heating.
  • Separate the technical network from the rest. In Lviv, the router, the servers and the controllers shared the same network. The boiler room, the building management system and the doors have no business being on the managing agent’s office network or on the caretaker’s.
  • Activate the firewall and change the factory passwords. The Finnish controllers were supplied with a firewall that had to be activated. In 2016, the Mirai botnet enlisted hundreds of thousands of cameras and video recorders whose factory credentials had not been changed; the US-CERT alert of October 2016 recommends changing those credentials and taking those devices off the Internet.
  • Know who applies the updates, and when. In May 2013, the supervisory system of a Google office building in Sydney was still running a version for which a patch had existed since August 2012 (advisory ICSA-12-228-01). The contract must name the person responsible for updating the controller and the gateway.
  • Require two-factor authentication on every remote access. In Ukraine, a VPN used with stolen credentials was indistinguishable from legitimate access. A fitter who connects with a simple password exposes the building to the same situation.
  • Plan for degraded mode. Ten months of silent presence in Lviv, a few days to understand in Lappeenranta, two months of manual operation in Ukraine: the question to put to the fitter is “who restarts the boiler room if the remote management system is lying?”. A fixed setpoint or a local manual override must remain possible without the network.
  • Monitor remote access and know whom to call. The Finnish maintenance staff first looked for a local fault. A log of connections to the remote management system, read regularly, and a number to dial in case of doubt (the fitter, then CIRCL in Luxembourg) avoid losing days.
  • Protect the managing agent’s workstation too. The national CSIRT describes in its TR-93 report of February 2025 accounting workstations compromised by a fake invoice, followed by fraudulent transfers abroad; it recommends four-eyes validation and removing the smart card from the reader when it is not in use. A change of bank details received by email is verified through an independent channel, and offline, tested backups remain the answer to encryption.
  • Notify without delay. If co-owners’ personal data are affected, the CNPD must be informed within 72 hours (Article 33 of the GDPR) and the data subjects “without undue delay” (Article 34). During the cyberattack on the operator Encevo, in July 2022, the company notified the CNPD and the regulator and filed a complaint, stating that the supply of electricity and gas was not affected.
  • Check the facts before telling the story. “Russia cut off Lviv’s heating” is not what the investigation report says, and the Finnish ice rink did not melt. In front of a general meeting, stick to the established facts.

The Lappeenranta case sums it all up: a firewall was supplied with the controllers, yet they were reachable without protection, and getting them running again consisted of disconnecting them from the Internet. A firewall or a VPN costs less than a week without heating.

Sources