Residential HVAC Security for Techs: Wi-Fi, Firmware and Homeowner Accounts

In 2019, a Milwaukee couple’s Nest thermostat was cranked to 90°F while they were at work. After they turned it down, it kept climbing, and then a voice started talking to them through their Nest camera.¹ Google said its system had not been breached. The attacker most likely used a compromised password.¹

That is what most residential “smart home hacks” look like. Nobody cracked the thermostat. Somebody logged in.

For a residential shop, the expensive version plays out in the office. In May 2026, the ShinyHunters extortion group stole data from Baker Distributing, an HVAC/R wholesaler whose customers are mostly contractors. About 103,000 email addresses were exposed with names, phone numbers and support tickets.² Expect phishing emails that already know who your sales rep is.

What’s at Stake

• Comfort and property. A thermostat set back hard in January can freeze pipes. Furnace safety limits live in the equipment, not the thermostat, so the realistic worst case is a very cold or hot house.
• Privacy. A connected thermostat knows the household schedule and, with geofencing on, when nobody is home.
• The shop’s money. Business email compromise (BEC), where a crook poses as a supplier, customer or employee to redirect a payment, cost U.S. victims $3.05 billion in 2025.³
• Reputation. This spring, dozens of AI-generated fake HVAC company websites flooded Orlando search results. One real contractor cut five jobs and sold two vans.⁴ Gary’s own Facebook page was hijacked, and getting it back took a year and a half.

How They Get In

• Reused passwords. Passwords leaked from one site get tried everywhere else.
• Bank-change emails and fake invoices. “Our banking details have changed, please update your records.”
• Field service software takeovers. ServiceTitan, Housecall Pro and Jobber hold addresses, gate codes and payout accounts. The likely risk is someone logging into your account with a phished password.
• Impersonation. Look-alike websites and fake “technician invoice” texts to homeowners.
• Weak home networks. Default router passwords and never-updated thermostat firmware.

What AI Changes

On September 8, Meta launched Muse, a free AI agent that sends email, books appointments and makes purchases. It connects to email, payments and smart home apps, and can log in with credentials the user provides.⁵ Meta says passwords sit in a vault the AI can’t see. By default, Muse learns from what users share, and deleting a chat doesn’t erase what it learned.⁶

Muse may be well built. The pattern is still risky. In January, more than 1,800 instances of OpenClaw, a popular open-source agent, were found exposed online and leaking keys and credentials.⁷ And an agent that reads your email can be steered by an email written to give it instructions.

AI also sharpens the old scams. The FBI counted $893 million in reported AI-related fraud losses in 2025, driven by voice cloning, deepfakes and AI-written scripts.⁸ A cloned voice of the owner saying “pay this supplier today” is cheap to fake.

None of this means avoiding AI. HKIA has covered the upside, from better troubleshooting prompts to AI booking tools. The rule from the BS detector for AI tools applies: know what it can touch before you trust it.

Best Practices in the Customer’s Home

Single-Family

• Hand the phone to the homeowner for the Wi-Fi password. Never store it in job notes or the CRM.
• Register the thermostat or communicating system to the homeowner’s account, then request contractor access they can revoke.
• Update firmware at install and help them turn on MFA (multi-factor authentication) in the app. Resideo recommends exactly that.⁹
• Explain what the device collects. Utility demand-response programs are opt-in in the U.S., and homeowners can skip individual events.¹⁰ Gary flagged that concern a couple of years back.

Apple’s thermostats, built with LG and Schneider Electric, ship in December.¹¹ Expect more privacy questions. Techs who know how smart thermostats work with zoning and how they communicate wirelessly will have better answers.

Multifamily

Shared infrastructure changes the math. In 2016, a botnet attack knocked out heating and hot water in two apartment buildings in Lappeenranta, Finland, for more than a week. The fix was putting the building controls behind a firewall.¹² Central VRF controllers belong on the same list: Mitsubishi Electric’s AE-200 and EW-50 controllers carried an authentication bypass rated 9.8 out of 10.¹³

Privacy matters more when the occupant didn’t choose the device. In December 2025, San Francisco tenants sued Equity Residential and SmartRent, alleging landlord-installed thermostats and sensors collected in-home activity data without meaningful consent.¹⁴ Those are allegations, not findings, and a preview of what tenants will ask the tech on the ladder.

Where Your Job Ends

Your lane	Homeowner’s lane	Manufacturer’s lane
Install habits and firmware at install	Router and Wi-Fi password	Cloud platform security
Never storing customer passwords	App account and MFA	Patches and updates
Explaining what the device collects	Deciding what to connect, AI agents included	Data handling and deletion

In multifamily, the property manager owns the shared network. Put findings in writing to them.

Protect Yourself and Your Shop

• MFA wherever money or customer data lives: email, field service software, banking and supply-house portals. ServiceTitan, Housecall Pro and Jobber all offer it now.¹⁵
• A callback rule for every payment change. In a 2024 Australian case, an electrical contractor’s email was hijacked and a customer paid A$235,400 to the fraudster. The court ruled the customer still owed the real invoice of about A$192,000.¹⁶ Put your bank details in the contract and tell customers you will never change them by email.
• Lock down customer codes. Gate, alarm and lockbox codes belong in restricted fields, not open job notes.
• Back up offline and test a restore. Ransomware showed up in 48% of breaches in Verizon’s 2026 report.¹⁷
• Know your reporting duties. In Canada, PIPEDA requires reporting to the Privacy Commissioner and notifying affected people when a breach creates a real risk of significant harm, and recording every breach for two years.¹⁸ Alberta and Quebec have their own rules. Every U.S. state has a breach-notification law.¹⁹
• Set AI rules: no customer data in public chatbots, no AI agent near banking or payouts, and a code word for urgent money requests by phone.
• Claim your Google Business Profile and search for look-alikes. AI search is changing who customers find.

Conclusion

For a residential shop, it comes down to the logins, the money, and how you leave the customer’s devices. Turn on MFA, put a callback rule on every payment change, and set up connected equipment so the homeowner owns it.

Run the five-minute HVAC Cyber Preparedness Scorecard, pick Residential, and work the ranked fix list. Doing commercial work too? Read the companion piece, Commercial HVAC Cybersecurity.

---

Additional Sources

1. “Couple says hacker took over Nest devices, talked to them”, ABC7 Chicago, News article, 2019.
2. “Baker Distributing Data Breach”, Have I Been Pwned, Breach record, 2026.
3. “2025 Internet Crime Report”, FBI Internet Crime Complaint Center, Government report, 2026.
4. “When the Competition Isn’t Real: AI Scam Sites Hit Orlando HVAC Contractors”, ACHR News, News article, 2026.
5. “Meta debuts its Muse AI agent. Will consumers trust it?”, TechCrunch, News article, 2026.
6. “Meta’s new Muse AI agent raises privacy concerns”, Atlanta News First, News article, 2026.
7. “OpenClaw AI Agent Exposes Widespread Security Vulnerabilities and Data Leaks”, OECD AI Incidents Monitor, Incident record, 2026.
8. “Americans lost nearly $900 million to AI-powered scams, FBI says”, Malwarebytes, News article, 2026.
9. “Smart Thermostats and Your Privacy”, CNET, News article, 2025.
10. “Addressing Smart Thermostat Privacy Concerns: What Contractors Can Do to Put Homeowners at Ease”, ACHR News, News article, 2026.
11. “Apple Launches Smart Thermostats With LG, Schneider Electric”, ACHR News, News article, 2026.
12. “Finns chilling as DDoS knocks out building control system”, The Register, News article, 2016.
13. “ICS Advisory ICSA-25-177-01: Mitsubishi Electric Air Conditioning Systems”, Cybersecurity and Infrastructure Security Agency, Advisory, 2025.
14. “Diestel et al. v. Equity Residential et al., Complaint”, ACLU of Northern California, Court filing, 2025.
15. Help documentation on multi-factor and two-step verification: ServiceTitan (Summer 2025 release notes), Housecall Pro, and Jobber, Vendor documentation, 2025 to 2026.
16. “BEC scams: first major Australian case authority and its impact (Mobius Group Pty Ltd v Inoteq Pty Ltd [2024] WADC 114)”, HWL Ebsworth Lawyers, Legal analysis, 2025.
17. “2026 Data Breach Investigations Report”, Verizon Business, Industry report, 2026.
18. “Privacy breaches at your business”, Office of the Privacy Commissioner of Canada, Government guidance, 2026.
19. “Data Breach Response: A Guide for Business”, Federal Trade Commission, Government guidance, 2019.