What would it be worth to you, during an incident, to cut off one vendor's connection to your chillers within the hour? Before you can answer, you need to know who can reach those chillers today. In many buildings the vendor set up the remote connection on a network the vendor installed, and nobody on site keeps a list of who can log in.
Two stories from the past few weeks make that question harder to put off. Attackers reached refrigeration controls in European grocery stores for the second time. Meanwhile, the companies that make chillers, air handlers, and controls have been buying the software that tells that equipment how to run. Taken together, this means a single company could supply your equipment, its controls, the software that optimizes it, and the remote connection that reaches it. You are still the one accountable when something on that connection goes wrong.
What happened to the refrigeration systems
According to Facilities Dive's report on the second refrigeration system hack, systems made by Danfoss, Copeland, and Dixell appear to have been targeted, based on news reports. These controls keep display cases and walk-in coolers at temperature, and when they fail, the store loses inventory.
The attacks have become a matter between governments. NPR reports that France has accused Iran of cyber "sabotage" in the refrigeration attacks. If France is right, someone with a government behind them decided that equipment controls were worth attacking.
The reports don't say how the attackers got in, but you can check how your own vendors get in. Equipment makers and their service contractors usually want to watch alarms and change settings without sending a truck, so they set up a remote connection. The service team uses that connection to do its job, and anyone who takes over the vendor's account can use it too.
The same companies now sell the controls and the software
Memoori's 2026 research on HVAC optimization reports that in less than two years, the companies that make the chillers, air handlers, and controls inside commercial buildings have bought their way into the software that optimizes them. Smart Building Insight's market ledger for September and October tracks more acquisitions among companies selling software for building operations. My guess is you'll be dealing with fewer, larger vendors, each responsible for more of what runs your building: the equipment, the controls, the optimization software, and the remote connection.
That raises a practical question for you. When one vendor holds all four, what can that vendor change in your building, and what could someone who breaks into that vendor change? If each system arrived with its own connection and nobody wrote any of them down, you probably can't answer that today.
Why an undocumented connection is hard to shut off
Walk enough buildings and you'll run into this one. During commissioning, the HVAC contractor sets up a remote connection so the service team can reach the controls, and nobody records it anywhere the owner can find it. Years later, the service contract has changed hands and the original technician has moved on. The chief engineer knows the system works and has a phone number to call when it doesn't, but can't tell you who else is able to log in.
When a vendor's account is compromised, containing it takes two steps: separate the affected system from the rest of the building, and shut off that one vendor's access while everything else keeps running. Both require a network that keeps each system on its own segment and a written list of who has access. Without them, your engineers can't do either step, and you end up waiting for the vendor to explain what happened while the vendor deals with its own breach.
The costs reach the operating statement quickly. A grocery tenant whose cases warm up loses stock. An office or apartment building that loses heating or cooling runs up emergency service calls and complaints, and a tenant whose operation stopped because of the landlord's controls has a reason to bring it up at renewal. If a buyer or lender asks who can reach the building controls and you have no documented answer, you've given them a reason to lower the price or tighten the terms.
The savings depend on the same answer
One number in Memoori's research deserves a closer look. By Memoori's estimate, software that optimizes heating, cooling, and ventilation pays back in about two years. Yet only 2 to 5% of commercial buildings let that software control HVAC automatically.
What's it really worth? Heating and cooling is usually one of a building's largest energy costs, so a two-year payback on it would be one of the faster returns available to you. Memoori gives its own reasons for the slow adoption, and I think trust is part of it. Letting software run your chillers means trusting the software, the vendor behind it, and the connection between them. If you can't see who has access, can't limit what the software is allowed to change, and can't take the data with you when the contract ends, keeping a person in charge of the chillers is a reasonable choice.
So the work that would let you contain an attack is the same work that would let you collect those savings. With your own segmented network, written access rules, and data you hold, you could give optimization software control on your terms and take it back when you need to. Utilities are one of three plays, with insurance and occupancy, behind the NOI (net operating income) lift owners can recover, and every dollar of that NOI shows up again in the asset's value at sale or refinance.
Three requirements, mapped to the PPP 5C™ plan
You need three things: a network you control, built so each system can be cut off on its own; remote-access rules every vendor has to follow, so you decide who gets in; and operating data that stays with you when a vendor changes, so a sale, a merger, or a contract dispute leaves your building's history with you.
One test covers all three: if you told a vendor today that its contract ends next month, could you shut off its access, keep its system running, and keep its data?
The Peak Property Performance® PPP 5C™ plan puts the work in order.
Clarify. List every remote connection into the building's controls, which vendor holds it, what it can reach, and when it was last used. Property Intelligence™ or a PPP Review™ is where that inventory starts.
Connect. Put every device and system on one secure, segmented network the owner controls. We call that approach BoT® (Building of Things®). SIC® is our engineering discipline for designing and operating that network, owner-controlled from day one. When a vendor adds a system, it joins your network under your rules.
Collect. Capture the operating data from the controls into a consistent model you hold under your own credentials. Property Brain™ analyzes data across your property's systems to investigate how the building is operating and answer questions the benchmark leaves open.
Coordinate. Every vendor connects through your access path, with a named identity, an approval step, a log of what was done, and a way to shut it off in minutes. Those logs also give you a record of what each vendor actually did in your building.
Control. Whatever optimization software you choose works from your data under your permissions, and if you change vendors, the history stays. Portfolio Brain™ analyzes across properties to compare performance, investigate shared issues, and assess where an improvement applies elsewhere. As I said on PPP Podcast Ep. 27: "I have the right to repair. I have the right to access. I have the right to make this data portable. It's my data. I just happen to be using you, Mr. Vendor... but I don't have to."
That's why we put the work in this order. If you don't own your data and digital infrastructure, your vendors do.
Your equipment makers build good systems, and consolidation may make those systems better. You can welcome that and still set the terms they work under, on a network that belongs to the building.
Where to start
This week, ask your chief engineer for one list: every vendor that can reach your building controls remotely, and what each one can change.
