Connected HVAC gear is convenient right up until nobody remembers what is connected, who administers it, or whether it still receives security updates. That is the homeowner-sized lesson worth taking from an ACHR News report on a cyberattack targeting supermarket refrigeration systems. The story says the incident caused food losses and disruptions in France while highlighting risks for connected refrigeration equipment in U.S. stores.
A residential heat pump is not a supermarket rack system, and the report does not establish that home equipment faces the same attack. It does establish a useful maintenance principle: equipment connected for monitoring or control has a digital failure path in addition to its mechanical and electrical ones.
Start with a physical inventory
Stand at the air handler, furnace, boiler, condenser, dehumidifier, ventilation controller, and any zoning panel. Record the manufacturer and model number of each control that communicates beyond the equipment cabinet. Include thermostats, Wi-Fi modules, wired Ethernet adapters, equipment gateways, leak sensors, condensate alarms, and energy monitors.
Do not assume a device is offline because you stopped using its app. Check the router's client list and match each unfamiliar entry to a physical device. A label on the equipment and a note in your home maintenance file will save detective work later.
For every connected device, answer five questions: What does it control? Which network does it use? Who owns the administrator account? Does remote access work? Is the product still supported? An unanswered question is not proof of danger, but it is a maintenance item.
Separate controls from everyday devices
If your router supports a guest or dedicated internet-of-things network, place HVAC controls there instead of on the same network used by laptops and file storage. Confirm first that the thermostat, gateway, and phone app will still communicate as intended. Some controls depend on local discovery, so network separation can interrupt setup or normal operation.
Use a unique password for each equipment account, enable multifactor authentication when the provider offers it, and remove access for former residents, installers, property managers, or family members who no longer need it. Save recovery information somewhere other than the phone that runs the app.
Router settings matter too. Install supported firmware, replace default administrator credentials, and disable remote router administration unless you deliberately use it. Avoid opening inbound ports merely to make an HVAC app work. If setup instructions demand that change, ask the manufacturer or installing contractor to explain the requirement and the safer supported configuration.
Prove the mechanical backup
Cybersecurity work should not leave the house without heat, cooling, or freeze protection. Before changing networks or removing an account, photograph the existing wiring and record thermostat configuration values. Know where the equipment disconnects and breakers are, but do not open energized cabinets merely to document a network connection.
Then test what happens when internet service is unavailable. The thermostat should still provide whatever local control its design supports. Verify that scheduled temperature changes, equipment staging, zoning, ventilation, and humidity control behave as expected. Product designs vary, so use the manuals rather than assuming every feature will survive an outage.
If a gateway provides the only practical interface for advanced settings, download the current documentation and record the support route. Ask the HVAC contractor whether normal service can continue without cloud access and which settings are stored locally.
Make service access temporary
Remote diagnostics can save a truck roll, but permanent access deserves the same attention as a key to the mechanical room. Before enabling it, identify the company, the account receiving access, the functions it can change, and the procedure for revoking permission.
After the service call, confirm whether access should remain active. Change shared credentials that were exposed during troubleshooting. If a contractor installed the controls under an employee's personal email address, move ownership to an account controlled by the homeowner.
Set a short annual check
Once a year, compare the router list with the physical inventory, install available updates through official channels, confirm account recovery details, and delete devices that have been removed. Also verify that alarms still reach the intended phones and that someone can operate the system locally.
The useful takeaway from the ACHR News story is not that every connected thermostat is under attack. It is that connected mechanical equipment deserves an ownership record, a controlled network path, and a tested fallback. Those are ordinary maintenance jobs, and a competent homeowner can document most of them before calling an HVAC technician or network professional for the parts that do not add up.