A thermostat app is easy to see. The rest of a connected HVAC system may be less obvious. A dealer portal, equipment gateway, building-control account or old installer login can remain out of sight while retaining some level of access.
That deserves attention after ACHR News reported that a cyberattack targeted refrigeration systems at French supermarkets, causing food losses and disruptions. The story concerns commercial refrigeration, not residential HVAC. Still, it highlights a useful household question: who can communicate with your mechanical equipment, and what can they change?
This is not a reason to rip out every connected control. It is a reason to document access with the same seriousness you bring to breaker labels, filter sizes and service records.
Start at the equipment, not the app store
Walk the system before opening any accounts. Photograph the thermostat model, indoor unit data plate, outdoor unit data plate and any small network boxes mounted nearby. Look for Ethernet cables, Wi-Fi indicators, antennas and labels mentioning gateways, hubs, remote monitoring or building automation.
Then check the router's client list. Names can be vague, so do not delete an unfamiliar device merely because you cannot identify it. Record its name, hardware address and connection type. Temporarily disconnecting an unknown device may interrupt controls or monitoring, so identify it through manuals or the servicing contractor first.
Build one inventory row for each connected component:
- Device and model
- Account owner and recovery email
- Phone running the control app
- Outside company with portal access
- Functions available remotely
- Local operating method if the connection fails
Separate visibility from control
Remote access is not one permission. A service company might receive fault notifications, view temperatures, change schedules, alter setpoints or update controller software. Those functions carry different consequences.
Ask the manufacturer or contractor to describe the actual permission level. Can the outside account only read alarms? Can it change operating modes? Can it add another user? Can the homeowner view and revoke that access without calling support?
Do not accept “connected” as a complete answer. Write down what crosses the network and which party controls the account. If nobody can explain a gateway's purpose, leave it connected until its role is established, but mark it unresolved.
Remove stale people before changing hardware
Account cleanup should follow any move, contractor change, divorce, employee departure from a home-based business or transfer of responsibility for a relative's house. Review named users, shared passwords, recovery addresses, authorized dealers and integrations with voice assistants or automation platforms.
Change reused passwords and enable multifactor authentication when the platform offers it. Give each regular user an individual login if supported. A shared household credential makes it harder to remove one person's access without disrupting everyone else.
If you are coordinating an older adult's household, keep HVAC credentials with the broader support plan instead of burying them in a technician's text thread. This before-we-talk checklist for families considering home care is one example of organizing responsibilities before a service conversation.
Prove the local fallback
After documenting access, test what remains available without the internet. Use the thermostat's physical controls to call for heating or cooling. Confirm that you can change the setpoint, select the operating mode and run the fan locally. Do not open energized equipment or bypass safety circuits for this test.
Next, disconnect only the home's internet connection, not power to the HVAC equipment. Verify that basic temperature control continues. Restore the connection and confirm that schedules, alerts and remote access recover. Record anything that fails, including whether the thermostat displays an error or holds its last schedule.
Finally, keep a paper recovery card near the equipment. Include model numbers, support contacts, account owner, recovery method and local operating instructions. Do not print passwords on the card.
The practical goal is modest: every connected HVAC device should have an identified owner, a known permission level and a tested local fallback. If one of those fields is blank, the system is not fully documented yet.