A connected thermostat is easy to recognize. The less obvious parts are the cloud account, phone app, Wi-Fi network, equipment gateway, installer portal, and remote service permissions behind it. Together, those pieces can change temperatures, schedules, alerts, and sometimes equipment settings without anybody standing in front of the air handler.
That deserves the same practical attention you give a condensate drain or disconnect. ACHR News reports that a cyberattack targeting French supermarket refrigeration systems caused food losses and disruptions. The story concerns commercial refrigeration, not residential HVAC. Still, its useful lesson for homeowners is straightforward: connected climate equipment is also computer equipment, and its access paths need maintenance.
Start with an equipment and account map
Stand at the thermostat and identify what it actually controls. Then work outward. Record the thermostat model, app name, account email, Wi-Fi network, attached gateway or hub, and any utility or contractor program connected to it. Check whether zoning panels, mini-split adapters, indoor air quality controls, or equipment monitoring modules have their own network connections.
Do not assume one app means one account. A thermostat may use a homeowner login while a dealer-facing platform retains separate remote access. Ask the installing contractor exactly what they can see and change. If the company no longer services the house, remove its access if the platform permits it. Ownership changes, employee departures, and abandoned email addresses are ordinary reasons to clean up permissions.
Protect the control path, not just the thermostat
A strong password on the thermostat account helps, but it is only one link. Change the router's default administrator password. Install router and HVAC device updates through the manufacturer's normal interface. Enable multifactor authentication wherever it is available. Give each household user a separate login instead of sharing one password by text message.
Put connected HVAC devices on a guest or dedicated device network if your router supports one. The goal is separation: a cheap connected plug or aging camera should not automatically share the same local access as every computer and control device in the house. Network menus vary, so confirm that the isolated network still provides the internet access required by the thermostat before calling the job done.
Also inspect account recovery. Confirm that the recovery email and phone number still belong to you. Save the manufacturer's support page, device serial number, and proof of purchase somewhere other than the app. Those details matter when the app itself is inaccessible.
Prove what works without the cloud
Do a controlled test on a mild day. First, note the current setpoint, schedule, mode, and fan setting. Disconnect the thermostat or gateway from Wi-Fi without switching off HVAC power. Verify that you can still change the setpoint locally and produce a normal heating or cooling call. Restore the connection and confirm that the schedule and displayed equipment status remain correct.
This is not a reason to jumper terminals casually. Modern communicating systems may not use conventional thermostat wiring, and an incorrect jumper can damage a control board or transformer. If you use a multimeter, follow the equipment documentation and measure only at points you understand. Shut off power before opening panels unless a specified diagnostic requires energized testing.
Write down the local fallback procedure. Some systems continue the existing schedule. Others retain basic wall control but lose remote changes, weather-based features, or alerts. The answer should come from your own test and the documentation for your exact model, not a generic smart-home assumption.
Watch for changes that do not fit
A surprise setpoint is not proof of an intrusion. Utility programs, geofencing, recovery modes, schedules, and another household user can all produce legitimate changes. Troubleshoot in order: review the schedule, app activity, enrolled energy programs, authorized users, and installer access. Then change credentials, sign out other sessions if the service offers that control, and contact the manufacturer when the activity remains unexplained.
After any account reset, verify operation at the equipment. Make a heating or cooling call, confirm airflow, and watch the system complete a normal cycle. Cybersecurity work is unfinished if the house is left with a locked account, erased schedule, or thermostat that no longer communicates with the system.
Add this review to annual HVAC maintenance and repeat it whenever the router, thermostat, installer, utility program, or homeowner changes. You are not trying to turn the mechanical room into a security operations center. You are making sure you know every route into the controls, who holds the keys, and how the equipment behaves when a digital route fails.