In what sounds like a plot in a bad Adam Sandler film, a security company has discovered a brand of hot tubs that can be easily hacked.

Described in excruciating details over the weekend by security researchers at Pen Test Partners Ltd., the vulnerability relates to the Balboa Water App, a mobile app used for controlling around 30,000 hot tubs manufactured by Balboa Water Group Inc.

The researchers found that the app, which connects to a hot tub over Wi-Fi, did not correctly authenticate users, potentially allowing third parties to gain access. Worse still, the location of hot tubs could also be discovered since the lack of authentication on the receiving end allowed the researchers to map their locations.

OK, so it’s unlikely that anyone would actively seek to hack hot tubs. But the researchers did note that the access would allow someone to increase or decrease the heat in the hot tub.

“It’s easy to turn your temperature down so your tub becomes unusable. It’s also easy to heat it continuously, wasting electricity,” the researchers note. “Blowers are also only turned on when someone is in the tub, so the hacker can figure out if you’re in the tub at the time. Creepy.”

In response to the news, BWG, the company behind the hot tubs told the BBC that it had been “surprised” to learn of the flaw since its app had been available for five years during which users had not reported any problems.

It went on to note that it was working with more than 1,000 owners in the U.K. and others globally to set up a system of individual usernames and passwords to secure the online controls. Perhaps worse still, it added that it had previously opted not to do so because it had wanted to “allow for simple and easy use and activation” by homeowners.

Image: Pen Test Partners