A thermostat with Wi-Fi is not just a wall control. It is also a network endpoint, tied to an app, an account, a router, and sometimes a cloud service. Add a connected heat pump controller, zoning panel, leak detector, water heater, or indoor air quality monitor, and the mechanical room starts to look a little like an equipment rack.
That deserves attention because connected refrigeration equipment has already shown how digital trouble can produce physical consequences. ACHR News reports that a cyberattack targeting French supermarket refrigeration systems caused food losses and disruptions, a case that highlights risks for connected refrigeration in U.S. stores. The report on the refrigeration-system cyberattack does not establish that residential HVAC equipment faces the same threat or consequences. It does establish a useful principle: once mechanical equipment depends on networked controls, cybersecurity belongs on the maintenance list.
Start with an equipment inventory
Walk the house and list every comfort or water device that connects to Wi-Fi, Ethernet, Bluetooth, a proprietary hub, or a cellular service. Record the manufacturer, model, app name, account owner, installation date, and physical location. Photograph the model and serial labels while you are there.
Do not stop at the thermostat. Check equipment cabinets, condensate pumps, zoning controls, ventilation controls, water heaters, softeners, leak shutoff valves, sump alarms, and energy monitors. A device may be connected even if nobody currently uses its app.
Then open the router interface and compare its client list with your inventory. Names can be cryptic, so confirm devices one at a time rather than blocking an unfamiliar entry on a guess. Label recognized equipment in the router if that feature is available.
Separate controls from casual devices
If your router supports a separate internet-of-things network or isolated guest network, consider placing compatible mechanical devices there. The objective is simple: a thermostat may need internet access, but it usually does not need open access to laptops, shared drives, cameras, or the computer used for household finances.
Network changes can break commissioning tools, local integrations, or communication between a hub and its devices. Before moving anything, document the existing network name, connection method, and app status. Change one device at a time, then confirm that schedules, remote access, alerts, and equipment calls still work.
Do not place a control on an isolated network when the manufacturer or installer requires local communication that the network would block. Segmentation is useful only when the system remains operable.
Clean up accounts and updates
Each equipment account should have a unique password. Enable multifactor authentication when the service offers it. Remove access for former occupants, previous contractors, unused household accounts, and old phones. Confirm that the recovery email and phone number still belong to someone responsible for the property.
Check whether device and app updates are automatic. If they are manual, add a quarterly reminder to look for updates through the manufacturer’s official app or support channel. Avoid downloading firmware from file-sharing sites or links in unsolicited messages.
The router matters too. Record its model, confirm that its administrative password is not the factory default, and determine whether it still receives security updates. Replacing an unsupported router can be more consequential than buying another smart sensor.
Prove the fallback before you need it
Disconnect the thermostat from Wi-Fi temporarily and verify what still works. A typical system may continue following a local schedule or accept commands at the wall, but behavior varies by product and configuration. Test rather than assume.
Know how to make a basic heating or cooling call locally. Keep installer contact information, equipment model numbers, configuration notes, and the thermostat manual somewhere accessible without the affected account. Do not experiment with hidden installer menus or change equipment type, staging, reversing-valve logic, or temperature limits unless you know the correct settings.
If a connected control begins behaving strangely, photograph the display and note the time, operating mode, setpoint, indoor temperature, and equipment response. Check for an ordinary power, condensate, breaker, battery, or communication fault before calling it a cyber incident. If several connected devices fail together while local mechanical operation remains available, preserve the evidence and contact the equipment provider and network administrator.
The practical standard is not a perfectly sealed smart home. It is a documented system with limited access, maintained software, and a tested local fallback. Treat the controls like both HVAC gear and network gear, because they are now both.