A cyberattack targeting supermarket refrigeration systems in France caused equipment disruptions and food losses, according to ACHR News coverage of the connected-refrigeration attack. A residential heat pump is not a supermarket rack, but the story exposes a useful question for homeowners: If your thermostat app, cloud account, or internet connection stopped cooperating tonight, could you still operate the equipment?
This is not a reason to rip every connected control off the wall. It is a reason to run a controlled recovery drill while the house is comfortable and the service department is open. The objective is simple: prove which functions remain available locally, preserve the information a technician will need, and avoid turning an account problem into random rewiring.
Start at the wall, not in the app
Put the phone down and operate the thermostat from its physical interface. Change the setpoint by a few degrees and confirm that the screen accepts the command. Check whether you can select heat, cool, off, and fan without an internet connection. Do not force the equipment to run outside appropriate weather conditions merely to complete the test.
Record what disappears when Wi-Fi is unavailable. Scheduling, remote access, weather data, energy reports, and geofencing may depend on outside services even when basic temperature control remains local. The distinction matters. A missing graph is an inconvenience. Losing the ability to select an operating mode requires a service plan.
Photograph the thermostat face, its model label, and every equipment-status screen you can reach without opening sealed or energized compartments. Also photograph the indoor unit and outdoor unit nameplates. Capture full model and serial numbers in focus. Those images can save a technician from diagnosing an unidentified system through a vague description such as “the smart thermostat is blank.”
Map the recovery route
Write down who owns the thermostat account, which email address receives recovery messages, and whether multifactor authentication is enabled. Confirm that the recovery email and phone number still work. If a previous homeowner, former employee, or installer controls the account, correct that ownership problem before an outage.
Next, locate the paper or downloaded installation manual. Find the documented procedures for restarting the thermostat, reconnecting it to Wi-Fi, and performing an account transfer. Do not perform a factory reset as an experiment. A reset can erase configuration details, schedules, equipment selections, and installer settings. Treat it as a specific repair step, not the universal first move.
Record the HVAC contractor’s regular and after-hours numbers separately from the app. If the app is the problem, it should not also be your only path to help. Ask the contractor whether it supports your exact thermostat model and whether it can recover the existing configuration before replacing hardware.
Preserve the wiring evidence
If you can safely remove only the thermostat’s cosmetic faceplate as the manufacturer permits, photograph the terminal letters and connected wire colors without disconnecting anything. Shut off the appropriate HVAC power first if the instructions require it. Never assume wire color proves function. The terminal designation and the equipment configuration matter more than whether a conductor happens to be red, white, or green.
A multimeter can confirm that power is absent, but it does not make unfamiliar control wiring self-explanatory. Do not jumper terminals to see what happens. Modern communicating equipment may not use conventional thermostat logic, and an improvised jumper can create a second fault that obscures the first one.
Know when the drill becomes a service call
Stop and call for service if the thermostat is blank despite confirmed household power, repeatedly reboots, reports equipment faults, smells hot, or shows damaged wiring. Also stop if the system will not respond to local commands after internet access is removed. Note the exact time, outdoor conditions, displayed message, and what the equipment did. Avoid clearing alerts until you photograph them.
Your finished recovery sheet should contain account ownership, recovery contacts, thermostat and equipment models, contractor numbers, local-control results, and labeled photos. Store a printed copy near the air handler documentation and a digital copy somewhere other than the thermostat account.
The French refrigeration incident reported by ACHR News involved commercial systems and consequences beyond a typical house. The practical residential lesson is narrower: connected equipment needs a tested local operating path and a documented recovery path. Run that drill before cold weather turns a forgotten password or unreachable service into an emergency.