INDUSTRY FACT FILE · REAL ESTATE, CONSTRUCTION & FACILITIES

Five New Case Studies in Building and Construction Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in developers, contractors, property groups, co-working operators and facility managers and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Building That Answered to the Internet 3.  Case Study 2: The Running Account Bill That Paid Someone Else 4.  Case Study 3: The Cameras Nobody Owned 5.  Case Study 4: The Launch Weekend With No CRM 6.  Case Study 5: The Co-working Space That Shared Everything

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in real estate, construction and facilities with the obligations that apply in India as of October 2026—in particular CERT-In's Directions and audit guidelines, SEBI disclosure for listed companies, RERA, DPDP and MeitY's CCTV requirements.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Building That Answered to the Internet	Commercial property group	Internet-exposed BMS used to disrupt a tower	CERT-In; SEBI LODR; occupier leases	B1, B3, B7
2. The Running Account Bill That Paid Someone Else	EPC and construction company	Business email compromise diverting a subcontractor payment	CERT-In; lender covenants; police complaint	B10, B2, B7
3. The Cameras Nobody Owned	Facility management company	Shared cloud CCTV credential exposing client sites	DPDP; MeitY CCTV ER; client contracts	B1, B6, B9
4. The Launch Weekend With No CRM	Residential developer (listed)	Ransomware and buyer data theft at project launch	CERT-In; RERA; DPDP; SEBI LODR	B3, B7, B8
5. The Co-working Space That Shared Everything	Co-working and flexible workspace operator	A member device reaching door controllers and other members	CERT-In; DPDP; enterprise client contracts	B3, B1, B2

The lifts stopped on the thirty-second floor first. Then the cooling went.

At a glance
Organisation	A listed commercial property group (“Towerco A”) operating a 40-storey office tower leased to GCCs
Threat	An internet-exposed building management server with vendor default credentials used to alter HVAC set-points and lift group control
Why it is new	Building systems now fail in front of tenants, and are reachable by anyone who finds them
Codec Networks services	Building system assessment, segmentation and vendor access design, building SOC (Bundles B1, B3, B7)

The scenario

Towerco A's BMS integrator had left the building management server reachable from the internet for remote support, with the vendor's default administrator password unchanged since commissioning.

Attackers who found the server through a scanning service logged in, raised chiller set-points, disabled fresh-air dampers and took lift groups out of service floor by floor on a summer afternoon. The lobby access gates failed open when the controller lost its connection.

Tenants evacuated three floors; the FM team reset systems manually over two days. Investigation found the BMS, CCTV and corporate IT on one flat network and no record of vendor sessions.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• BMS reachable from the internet with default credentials.
• No segmentation between building, security, corporate and tenant networks.
• Standing vendor access with no brokering or recording.
• No monitoring of building system changes.

The impact

Towerco A faced tenant claims for business disruption, an occupier's demand for an independent assessment before renewal, reported the incident and disclosed it in its quarterly corporate governance report.

The regulatory lens

• CERT-In Directions: incident reported within six hours; logs needed for investigation.
• SEBI LODR: cyber incident disclosed in the quarterly corporate governance report.
• Occupier leases: service-level and security clauses invoked by tenants.

How Codec Networks would help

Need	Codec Networks response	Bundle
Know the building	Building system assessment of BMS, lifts, access control and network architecture	B1
Separate and control	Segmentation design and brokered vendor remote access with MFA and recording	B3
Watch the building	Building SOC monitoring configuration changes and vendor sessions	B7

Key lessons Treat handover as a security milestone: change defaults, close exposure. Separate building systems from IT and tenants. Broker and record every vendor session. Monitor building changes, not just IT.

The invoice was genuine. The bank account was not.

At a glance
Organisation	A mid-sized EPC contractor (“Buildco B”) running a 30-storey residential project with 60 subcontractors
Threat	A phished subcontractor mailbox used to insert a fraudulent bank-detail change into a running-account billing thread
Why it is new	Construction's predictable billing cycles and many counterparties make it a prime BEC target
Codec Networks services	BEC simulation and payment controls, ERP master-data controls, SOC (Bundles B10, B2, B7)

The scenario

Attackers phished a project manager at one of Buildco B's structural subcontractors and watched the monthly running-account billing thread for two cycles.

At the next cycle they registered a look-alike domain, replied in the thread with a letter on the subcontractor's letterhead changing bank details, and followed up by phone. Accounts payable updated the vendor master and released ₹3.8 crore.

The real subcontractor stopped work when wages went unpaid; the site lost three weeks, the money had left the mule account, and Buildco B filed a police complaint and an insurance claim.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• No call-back verification of bank-detail changes.
• Single approval for vendor master-data changes.
• No monitoring of look-alike domains or external reply chains.
• No BEC training for site and finance teams.

The impact

Buildco B lost ₹3.8 crore, three weeks of site progress and a lender's confidence, and renegotiated its subcontractor contract with security and verification clauses.

The regulatory lens

• CERT-In Directions: the fraud and underlying compromise reported within six hours.
• Lender covenants: reporting of material losses and controls review.
• Criminal law: police complaint and bank recall attempts.

How Codec Networks would help

Need	Codec Networks response	Bundle
Fix the process	BEC simulation, call-back and dual-approval design, finance and site training	B10
Harden the ERP	Vendor master-data change controls and alerting in ERP and portals	B2
See it coming	SOC monitoring of email, look-alike domains and payment anomalies	B7

Key lessons Verify every bank-detail change by call-back. Require dual approval for master-data changes. Train the people who pay bills with real simulations. Monitor email and domains, not just malware.

Forty lobbies, twelve crèches and three server rooms—live, for anyone who paid.

At a glance
Organisation	A national facility management company (“Facilco C”) operating CCTV for 40 client sites on one cloud video platform
Threat	A shared administrator credential stolen by infostealer malware and sold online, giving live and recorded access to every site
Why it is new	Cloud video platforms concentrate privacy and safety risk across portfolios
Codec Networks services	CCTV and VMS assessment, DPDP programme, vendor assurance (Bundles B1, B6, B9)

The scenario

Facilco C's field technicians shared one administrator login for the cloud video platform, saved in browsers on personal laptops. One laptop was infected with infostealer malware and the credential appeared in a log sold on a criminal forum.

For six weeks buyers browsed live feeds of client lobbies, crèches and server rooms and downloaded recordings. A tenant found clips of its office on a video site and complained to its landlord.

Facilco C could not say who had viewed what, had no retention policy and had installed cameras that had not been tested against MeitY's essential requirements.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• Shared administrator account without MFA or rotation.
• No audit logging of views and exports.
• No retention or privacy policy for footage.
• Cameras not aligned to MeitY essential requirements.

The impact

Facilco C lost two client contracts, funded independent assessments for the rest, notified affected tenants and rebuilt its video platform governance.

The regulatory lens

• DPDP: footage identifying individuals is personal data; notices, access controls and breach intimation apply from May 2027.
• MeitY CCTV essential requirements: cameras sold and installed from April 2025 must meet security requirements with STQC testing.
• Client contracts: security and notification clauses invoked by landlords and occupiers.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the platform	CCTV, VMS and cloud video assessment with identity and logging controls	B1
Govern the data	DPDP programme for surveillance: notices, retention, access and breach playbook	B6
Prove it to clients	FM vendor assurance programme and contractual security evidence	B9

Key lessons No shared accounts on video platforms—named users, MFA, rotation. Log and review who views and exports footage. Treat footage as personal data under DPDP. Specify and evidence MeitY-compliant cameras.

Two thousand site visits were booked. The booking system was a ransom note.

At a glance
Organisation	A listed residential developer (“Homeco D”) launching a 1,200-unit township
Threat	Phishing leading to domain compromise, exfiltration of buyer KYC data and ransomware across ERP, CRM and document servers
Why it is new	Launches concentrate revenue, data and attention into one weekend
Codec Networks services	Segmentation and backups, SOC, forensics (Bundles B3, B7, B8)

The scenario

A phishing email to a channel-partner manager gave attackers a foothold three weeks before launch. They escalated to domain administrator and exported the CRM's buyer database—names, PAN, bank details and payment schedules—before encrypting ERP, CRM, document servers and the domain-joined backup server on the Friday night of launch weekend.

Sales teams fell back to WhatsApp and paper; receipts could not be issued and collections stalled. Within days buyers received messages impersonating Homeco D with payment links to attacker accounts.

Recovery took three weeks. RERA quarterly filings slipped, buyers complained to the state authority, and Homeco D disclosed the incident.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• Backups online and domain-joined, so they were encrypted too.
• No manual booking and receipt playbook for launch.
• EDR alerts unmonitored for three weeks.
• Buyer data unclassified and exportable in bulk.

The impact

Homeco D lost launch momentum and collections, funded buyer notifications and fraud response, disclosed under SEBI LODR, faced RERA queries and rebuilt its IT and data governance.

The regulatory lens

• CERT-In Directions: incident reported within six hours; logs needed for investigation.
• RERA: filings, escrow reconciliation and buyer communications disrupted.
• DPDP: buyer personal data exfiltrated; breach intimation duties from May 2027.
• SEBI LODR: cyber incident disclosed in the quarterly corporate governance report.

How Codec Networks would help

Need	Codec Networks response	Bundle
Separate and recover	Immutable backups, tested ERP and CRM restores, segmentation	B3
Detect early	24x7 SOC with EDR monitoring and threat hunting	B7
Investigate and report	Forensics, buyer-data impact analysis, CERT-In and disclosure support	B8

Key lessons Keep backups immutable and off the domain. Rehearse launching without IT. Monitor EDR around the clock, especially before launches. Classify and limit bulk export of buyer data.

The hot desk came with coffee, Wi-Fi and every other company's files.

At a glance
Organisation	A co-working operator (“Flexco E”) with 18 centres hosting start-ups and enterprise teams
Threat	Malware on a member's laptop scanning a flat network and reaching the access control controller and a tenant's NAS
Why it is new	Shared workspaces put hundreds of unrelated businesses and the building's doors on one network
Codec Networks services	Segmentation, access control assessment, member app and API testing (Bundles B3, B1, B2)

The scenario

Flexco E ran member Wi-Fi, printers, access control and its own systems on one network at each centre. A member's infected laptop scanned the network from a hot desk and found the access control controller's web interface, still on its default password, and a start-up's network storage.

Over two nights, door schedules were altered to leave side doors unlocked and client files were copied. The start-up discovered the theft when a competitor contacted its customers.

An enterprise client's security team then found that Flexco E's member app exposed room-booking and door-unlock APIs without proper authorisation, and terminated its contract.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• No member isolation on the network.
• Access control controller on the member network with default credentials.
• Member app APIs without proper authorisation checks.
• No network monitoring for scanning or malware.

The impact

Flexco E lost an enterprise client, compensated the start-up, reported the incident and re-architected its centres' networks and app.

The regulatory lens

• CERT-In Directions: incident reported within six hours.
• DPDP: member and visitor data in the app and access system.
• Enterprise client contracts: security requirements and termination rights.

How Codec Networks would help

Need	Codec Networks response	Bundle
Isolate members	Segmentation design: member, operator and building system networks with network access control	B3
Harden the doors	Access control and visitor system assessment and hardening	B1
Test the app	Member app and API penetration testing and secure development	B2

Key lessons Isolate every member from every other member and from building systems. Keep door controllers off shared networks and change defaults. Test the APIs that open doors. Monitor shared networks for scanning and malware.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com