A recent ACHR News report on a cyberattack targeting French supermarket refrigeration systems describes food losses and operational disruption, while raising concerns about connected refrigeration equipment in U.S. stores. A supermarket rack is not a residential heat pump, but the incident makes one distinction worth carrying into the mechanical room: electrical protection and cybersecurity solve different problems.
A surge protective device can help defend equipment against damaging voltage transients. It cannot protect a cloud account, block a stolen password, restore a failed vendor service, or recover a controller that has lost network access. Likewise, a strong password will not absorb a utility switching transient or a nearby lightning-induced surge.
Homeowners shopping for connected HVAC equipment should evaluate those two failure paths separately. The useful question is not whether the system is smart. It is what still works when one of its dependencies disappears.
Start with the electrical protection path
Ask the HVAC contractor or electrician where surge protection will be installed and which equipment it covers. A whole-home device at the service equipment can provide one layer of protection. Sensitive outdoor units, communicating controls, and other electronics may warrant additional protection selected for the equipment and installation.
Do not judge a surge protective device by the size of its enclosure. Record the manufacturer, model number, voltage configuration, nominal discharge current, voltage protection rating, short-circuit current rating, and required breaker or overcurrent protection. Confirm that the product is listed for its application and installed according to its instructions.
Lead length matters. Long, looping conductors add impedance and can reduce performance during a fast transient. That is an installation issue for a qualified electrician, not an invitation to rearrange energized panel wiring yourself.
Also ask how you will know when the device has reached end of life. Many units have indicator lights, audible alarms, dry contacts, or replaceable modules. Put the inspection method in the equipment file and check it after major electrical disturbances and during routine service.
Then trace the connection path
Make a one-page inventory of anything the comfort system needs beyond power. Include the thermostat, equipment control board, gateway or hub, Wi-Fi network, mobile application, vendor account, email address used for recovery, and any third-party automation platform.
For each item, ask three practical questions: Can the system heat or cool without it? Can basic settings be changed locally? Who can restore access?
A connected thermostat may still operate locally when the internet is down, but that should be confirmed for the exact model and control architecture. Some equipment uses communicating controls that should not be replaced casually with a generic thermostat. Get the contractor to explain the fallback behavior before installation, then have someone demonstrate it at commissioning.
Account ownership deserves the same attention as wire labels. Use an email address the homeowner controls, enable multifactor authentication when offered, store recovery information securely, and remove access for former residents, contractors, or employees who no longer need it. If the installer creates the account, transfer ownership before the job is closed.
Put five tests on the commissioning sheet
Before final payment, run a short acceptance check with the installer:
1. Disable internet access temporarily and verify which local heating, cooling, fan, and temperature functions remain available.
2. Restore the connection and confirm that the thermostat, gateway, and application reconnect without rebuilding the system.
3. Identify every breaker, disconnect, transformer, and surge protective device associated with the equipment.
4. Confirm where diagnostic history and configuration data are stored, and whether a factory reset would erase settings that require a service technician to restore.
5. Record support numbers, model and serial numbers, account ownership, warranty registration, and the installer’s recovery procedure.
Do not simulate faults by opening equipment cabinets, moving conductors, or working inside an energized panel. The homeowner’s role is to observe normal controls, document the system, and understand the handoff. Electrical testing and internal equipment work belong with qualified tradespeople.
Ask for two answers, not one promise
When a salesperson says the system is protected, ask protected from what. You want one answer covering power quality, grounding, overcurrent protection, disconnects, and surge protection. You want another covering network dependence, account control, software access, and manual fallback.
The French refrigeration story does not establish that a particular home system is vulnerable. It does show why connected cooling equipment should not be treated as merely another appliance on Wi-Fi. A good installation leaves the homeowner with more than an application. It leaves a labeled electrical path, a documented connection path, and a workable way to maintain basic comfort when either path has trouble.