A thermostat used to be a switch on the wall. A connected thermostat may also be a Wi-Fi client, cloud account, phone app, voice assistant endpoint and gateway to additional HVAC controls. That convenience is useful, but it creates maintenance work that does not appear on a filter schedule.
ACHR News recently reported that a cyberattack targeted connected refrigeration systems at French supermarkets, causing food losses and disruptions. Residential HVAC is a different operating environment, and the story does not establish a specific threat to home thermostats. It does underline a practical point: equipment connected to a network deserves an inventory, an access plan and a fallback procedure.
Start at the equipment, not the app store
Walk the house and identify every comfort device that can communicate beyond its own cabinet. Include thermostats, zoning panels, indoor air quality controllers, mini-split adapters, equipment gateways and condensate or freeze sensors. Look for Ethernet cables, Wi-Fi setup labels and communication modules attached near the furnace, air handler or outdoor unit.
Write down the manufacturer, model, approximate installation date and physical location. Record which device actually controls heating and cooling. A wall thermostat may be only the visible part of a system that also depends on a gateway near the air handler.
Do not remove covers from energized equipment simply to complete the list. Model labels visible without defeating a safety panel are enough for the first pass. If access requires opening a line-voltage compartment, leave it for the next service visit.
Match every device to an owner
For each connected component, answer four questions: Which account manages it? Which email address owns that account? Which phones or tablets have access? Does a previous installer, homeowner or property manager still have permission?
This is where many systems become untidy. The thermostat works, so nobody checks whether recovery messages go to an abandoned inbox. A household member may have shared credentials instead of receiving a separate invitation. An installer may have legitimate service access, but the homeowner may not know where that permission is displayed or how to revoke it.
Use unique passwords and enable multifactor authentication when the manufacturer offers it. Update the recovery email and phone number. Remove devices and users you recognize as obsolete. If an unfamiliar user or integration appears, document it before changing settings, then contact the manufacturer or installing contractor through a verified support channel.
Check the network boundary
Log in to the router and compare its connected-device list with your equipment inventory. Names may be cryptic, so turn to model numbers, MAC addresses and connection times before assuming an unknown entry is hostile.
Keep HVAC devices off a guest network that regularly changes credentials. If your router supports a separate network for connected equipment, that arrangement can limit what those devices can reach. Do not create network isolation blindly, however. Some thermostats, hubs and phone controls need local communication to function. Make one change at a time and test heating, cooling, schedules, alerts and remote access afterward.
Also check for firmware updates through the manufacturer’s official app or support page. Avoid update links delivered through unexpected email or text messages. If a product no longer receives updates, ask the manufacturer what functions remain supported and whether local operation continues without its cloud service.
Prove the house still works offline
Disconnecting the internet should not become a midwinter experiment. Read the equipment instructions first, then identify what the thermostat can do locally if Wi-Fi or the vendor’s service is unavailable. Confirm how to change the mode and setpoint at the wall. Keep the HVAC contractor’s number somewhere other than the thermostat app.
If an outage leaves the system running normally at the wall, note which remote features disappear. If the equipment cannot be controlled locally, or if disabling a gateway interrupts basic operation, have an HVAC technician explain the control architecture and available fallback options.
A network inventory will not make connected equipment risk-free. It will tell you what is installed, who can reach it and what happens when connectivity fails. That is useful maintenance for any homeowner who expects the furnace to remain a furnace even when the cloud is having a bad day.