> There’s an HVAC company like this also, I’ll bet.

IIRC a hacked HVAC vendor was how credit card skimming software was infiltrated into Target and credit card data was exfiltrated a decade or so ago.

Edit, source: https://krebsonsecurity.com/2014/02/target-hackers-broke-in-...