Mobile-Menu

Cyber attacks on elevator systems. Elevators in the crosshairs of hackers: The growing importance of cybersecurity

A guest post by Markus Kling* | Translated by AI 4 min Reading Time

Related Vendors

FAULHABER Drive Systems
dataTec AG
Wuxi InfiMotion Technology Co., Ltd.

Cyber attacks on elevators? In our connected world, even the elevator industry is not safe from digital threats. Because cybersecurity goes far beyond the IT sector. What risks exist here and how can companies proactively protect themselves?

With the advancing digitization and networking of elevators, the risk of cyber attacks increases.(Image: freely licensed / Pexels)
With the advancing digitization and networking of elevators, the risk of cyber attacks increases.
(Image: freely licensed / Pexels)

Markus Kling is VP of Engineering at Digital Spine.

In today's digitally interconnected world, cyber attacks have become an omnipresent threat. The economy, citizens' privacy, and national security are repeatedly targeted by hackers. The increasing dependence on technology and the interconnection of this technology also means that critical infrastructures, including elevator systems, are vulnerable to such attacks.

Cybersecurity is no longer just a topic for IT specialists. As current statistics and reports show, the relevance of this issue is steadily growing - even in areas that at first glance are not directly connected to the digital space.

The economic dimension of cybersecurity in elevator systems.

Cybersecurity has gained importance in recent years not only due to the increasing number of cyber attacks, but also due to its significant economic impacts.

According to a survey from 2023, damages of around 205.9 billion euros per year are incurred in Germany due to hacker attacks. This figure is composed of direct financial losses, damage to reputation, operational interruptions, legal disputes and other post-incident costs.

For industries such as the elevator industry, where digitalization is progressing rapidly, potential risks are also increasing rapidly. Elevators today are much more than just mechanical systems; they are intelligent, interconnected systems that interact with other building systems and transmit data in real time. A cyber attack on such a system can not only affect the operation of the elevator itself, but can also endanger other interconnected systems in the building.

The financial consequences can be considerable:

  • Direct costs: Repair and restoration of systems, payments for ransom demands, replacement of damaged hardware.

  • Operational interruptions: A non-functioning elevator in a commercial building or large residential complexes can cause significant disruptions and associated costs.

  • Reputation damage: Loss of trust from tenants or building owners, which can lead to a decline in business activity or property values.

  • Legal consequences: Penalties or lawsuits that arise due to lack of cybersecurity measures.

It is therefore clear that the economic impact of a cyber attack on elevator systems can be immense. They extend far beyond the immediate repair costs and can have long-term damaging effects on business operations and brand image.

With the advancing digitization and networking of elevators, the risk of cyber attacks increases. The possible consequences - from trapping people to the failure of the entire system - are severe.

To counter these threats, legislators have responded. The "Law on Surveillance-Required Installations" (in short: ÜAnlG) and the "Operational Safety Ordinance" (in short: BetrSichV) form the legal basis for this. In addition, the technical rule TRBS 1115-1 was created, which specifies cyber security for safety-relevant measurement, control and regulation devices.

The TÜV Association has recognized these regulations and determined that they represent the current state of the art. This results in specific operator obligations that go beyond the classic, mechanical safety aspects.

Reactions and Challenges

The introduction of these regulations has elicited different reactions. While most associations recognize the necessity of the new regulations, there is debate over who ultimately bears responsibility for cyber security. The separation of product and operational requirements proves to be complex in this regard. There is consensus that both operators and manufacturers share responsibility.

Above all, operators face the challenge of developing and implementing appropriate security concepts. The question of the scope of protection, the integration of emergency call systems or building controls, and the role of TÜV are just some of many open points.

Best Practices and Approaches to Solutions

  • Risk Analysis: Start with a comprehensive analysis of all digital systems and interfaces in the elevator. Identify potential vulnerabilities and assess the risks.

  • Software Updates: Ensure that all software-based components are updated regularly. Outdated software is often vulnerable to attacks.

  • Access Restrictions: Implement strict access controls. Only authorized individuals should be able to make changes.

  • Encryption: Utilize modern encryption technologies to protect data transfers.

  • Regular Training: Sensitize staff to security risks and train them in secure practices.

  • Emergency Plans: Create detailed plans for the event of a cyber attack, so you can respond quickly and efficiently.

    Subscribe to the newsletter now

    Don't Miss out on Our Best Content

    By clicking on „Subscribe to Newsletter“ I agree to the processing and use of my data according to the consent form (please expand for details) and accept the Terms of Use. For more information, please see our Privacy Policy. The consent declaration relates, among other things, to the sending of editorial newsletters by email and to data matching for marketing purposes with selected advertising partners (e.g., LinkedIn, Google, Meta)

    Unfold for details of your consent

  • External Expertise: Consult cybersecurity experts to review your systems and provide recommendations.

  • Documentation: Keep a written record of all measures and protocols. This facilitates communication with regulatory authorities and reduces liability risks.

Future-oriented approaches

In a constantly changing digital landscape, it is imperative to always be one step ahead of cybersecurity threats. The basis of such an approach is a deep understanding of statutory requirements. Regularly updating and adapting to these regulations is not just a matter of compliance, but also protects against potential threats. Regular training and workshops for all relevant staff could be useful for this.

Risk analyses and preventive measures

Risk analyses play a central role in proactive security management. By identifying and assessing potential vulnerabilities, preventive measures can be taken and resources can be used more efficiently. It is important to consider both obvious risks and less apparent hazards.

External expertise and collaboration

Using external support, such as specialized cybersecurity firms or consultants, can be a valuable resource. These experts often bring a different perspective and can support in various phases of cybersecurity.

Another future-oriented approach is the integration of artificial intelligence and machine learning into safety systems. These technologies can help detect anomalies in the system and respond to them in real time.

People and culture

Cybersecurity is not just a technical challenge. It is an organizational issue that requires clear leadership responsibility, a culture of awareness, and continuous education. People - be they employees, customers, or partners - must be at the center of any security strategy.

Overall, it is crucial for companies to act proactively and not wait until a cyber attack has occurred to address cybersecurity. A forward-looking approach requires a combination of technology, education, collaboration, and continuous adaptability.

Related content