In 2013, attackers stole 40 million credit card numbers from Target. They didn’t break in through the point-of-sale system — they got in through credentials stolen from the retailer’s HVAC contractor. More than a decade later, the lesson still hasn’t reached most of the trades: if you install or service connected building systems, you’re part of your customers’ attack surface. And your own.
Why Contractors Are in the Crosshairs
Mechanical, HVAC, and electrical contractors sit in a uniquely exposed spot. You hold remote access to customer buildings — VPN credentials, vendor portals, and building automation system (BAS) logins. You move large sums through project draws and vendor payments, making you a prime target for wire fraud and invoice phishing. And most shops run lean on IT, which attackers know.
The BAS Problem Nobody Owns
A modern BAS is a network of computers controlling HVAC, lighting, and energy systems — often installed years ago, rarely patched, and frequently reachable from the internet. When something goes wrong, the building owner blames the controls contractor, the contractor points at the IT company, and nobody actually owns the security of the system. Search engines like Shodan make exposed building controllers trivially easy to find; researchers routinely turn up thousands of them with default passwords.
If your firm installs or services these systems, securing them is becoming part of the job — and increasingly part of the contract. General contractors and owners are starting to ask subs about cybersecurity practices the same way they ask about insurance and bonding.
Five Practical Steps for Trade Contractors
- Separate BAS access from everything else. Remote access to customer systems should go through dedicated, MFA-protected accounts — never a shared login on a tech’s laptop.
- Turn on multi-factor authentication. Email, VPN, and your accounting system first. Most wire-fraud losses start with a compromised email account.
- Verify payment changes by phone. Any request to change bank details on a project draw or vendor payment gets a phone call to a known number. No exceptions during busy season.
- Patch what you install. Build firmware updates into service agreements — it protects your customers and creates recurring revenue.
- Protect your field devices. Phones and tablets full of drawings, work orders, and customer access details need device management and remote wipe.
Where an IT Partner Fits
Most trade contractors don’t need in-house IT — they need a partner who understands both the office and the operational side. Boston Networks provides managed IT for mechanical, HVAC, and electrical contractors, including OT security for the building systems you install and layered cybersecurity for your own operation — from the front office to the truck.
Want to know where your exposure is? Schedule a consultation — we’ll look at your office systems and your field access practices together.