The heat pump as a gateway: cyber risks of connected HVAC systems
Heat pumps, chillers and dry coolers are almost always connected today: to the building management system, to vendor clouds and to remote maintenance portals. That saves time and energy. It also makes these systems a serious target – with consequences that go far beyond data loss.
Three developments come together: building automation protocols are old and unsecured, remote access via clouds and service companies is growing fast, and since September 2026 manufacturers of connected products face strict reporting duties. A successful attack can shut systems down, damage equipment and make buildings unusable.
1. Technical risks
Insecure protocols
BACnet and Modbus, which run most of today's building automation, were designed without cybersecurity in mind. At the NDSS Symposium 2026, researchers examined 15 BACnet and 5 KNX implementations from leading manufacturers and found 26 vulnerabilities. ASHRAE also confirmed a protocol-level weakness. The secured variant BACnet/SC (with TLS) addresses this, but is still rare in the field.
Write access between devices
BACnet's peer-to-peer design allows devices to write to objects in other devices. Anyone who gets onto the network can change setpoints, enables or operating modes.
Exposed web interfaces
Many controllers have a built-in web server. Security researchers have shown that BACnet's read and write functions can be used to inject malicious code into such devices, where it stays persistently in the device database.
Typical everyday weaknesses
- Default passwords and shared service accounts
- Firmware left un-updated for years
- Routers and gateways (often 4G/LTE) with port forwarding straight to the internet
- BMS, office IT and guest Wi-Fi on the same network, without segmentation
2. Supply chain and remote maintenance
The supply chain is arguably the biggest entry point today. Maintenance and building automation contractors work with very different levels of security. A well-known example from Germany: in 2021 a building automation engineering firm was attacked through a known but unpatched KNX vulnerability – the building itself was taken hostage.
Vendor remote maintenance portals, heat pump clouds and VPN boxes bundle access to many systems. If a single account is compromised, all of them are potentially affected.
3. Consequences of an attack
| Scenario | Impact |
|---|---|
| Cooling or heating shut down | Data centre, hospital or laboratory fails; buildings may become unusable or need to be evacuated |
| Manipulated setpoints and limits | Compressor damage, icing, high-pressure faults |
| Ransomware | Buildings stay closed until the systems are restored – a US school district had to close schools for this reason |
| Firmware tampering | Firmware or configuration corrupted via BACnet file services |
| Lateral movement | The BMS becomes a stepping stone into the corporate network |
| R290 systems | If safety logic (ventilation, gas detection) is bypassed, an additional safety risk arises |
4. Regulatory risks – new and pressing
Cyber Resilience Act (CRA)
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe security incidents in products with digital elements within 24 hours. This also applies to products already on the market. Fines can reach €15 million or 2.5 % of worldwide annual turnover. From 11 December 2027 the CRA applies in full, including CE marking and conformity assessment.
NIS2
Germany's NIS2 Implementation Act has been in force since December 2025. Around 29,500 companies have had to meet new obligations since then, and management is personally liable. Smaller companies are affected indirectly through the supply chain, when their customers are NIS2 entities and require cybersecurity by contract. Italy has also already transposed NIS2.
Further regulations
Since August 2025, cybersecurity requirements under the Radio Equipment Directive (RED) apply to radio devices. From January 2027 the new Machinery Regulation (EU) 2023/1230 includes requirements for protection against tampering. Where personal data is processed, such as occupancy or access data, the GDPR also applies.
5. What this means for manufacturers of system accessories
An acoustic enclosure made of profiles and panels is not a product with digital elements. That changes as soon as connected electronics are added – for example a controller for adiabatic pre-cooling with remote monitoring, temperature, sound or humidity sensors with cloud or BACnet connectivity, or fan and damper control via an app. Anyone placing such a product on the market under their own name is a manufacturer under the CRA. Using third-party controllers and gateways does not change that.
- Use proven, CRA-compliant controllers instead of in-house firmware
- Prefer local interfaces to the customer's BMS, ideally BACnet/SC; offer your own cloud only if you can maintain it for years
- Define a support period and a vulnerability reporting process for every connected product
- Draw a clear line: network security and remote access are the responsibility of the operator or BMS integrator
- Have a short security description ready for customers in the NIS2 environment
What operators should do now
- Segment networks: keep the BMS separate from office IT and guest Wi-Fi
- Never expose BACnet port UDP/47808 to the internet
- Remote access only via VPN with multi-factor authentication
- Replace default passwords consistently and schedule firmware updates
- Use BACnet/SC wherever possible
- Back up safety functions with hardware interlocks – especially in R290 systems
In building services, energy efficiency and cybersecurity now go hand in hand. The question is no longer whether a system is connected, but how well it is protected.
Note: This post is not legal advice. Whether the CRA applies in a specific case should be clarified with a specialist lawyer or a notified body.
Sources: NDSS 2026 – BACnet or “BADnet”? · Browne Jacobson – CRA reporting obligations · Jones Day – 24-hour reporting duties · SECJUR – NIS2UmsuCG · AutomatedBuildings – building automation as attack surface · Chipkin – impact of attacks on BACnet · HSToday – vulnerability in BACnet devices